This vulnerability affects code-projects Real State Services version 1.0. It is caused by improper sanitization of the 'loc' parameter in the /builderHome.php file, enabling remote attackers to inject SQL commands. The vulnerability allows attackers to manipulate database queries, potentially leading to unauthorized data access or modification. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and low impact on confidentiality, integrity, and availability. No official fix or patch has been published, and the vendor has not provided remediation details.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data disclosure, data modification, or other database-related impacts. However, the impact is rated as medium due to the low impact on confidentiality, integrity, and availability as per the CVSS vector. No known active exploitation has been reported despite public availability of exploit code.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation and parameterized queries as temporary mitigations to prevent SQL injection via the 'loc' parameter. Monitoring for unusual database activity may also help detect exploitation attempts.