Unrated severityNVD Advisory· Published Mar 15, 2026· Updated Mar 16, 2026
RealtyScript 4.0.2 SQL Injection via u_id and agent Parameters
CVE-2015-20121
Description
Next Click Ventures RealtyScript 4.0.2 contains SQL injection vulnerabilities that allow unauthenticated attackers to manipulate database queries by injecting arbitrary SQL code through the GET parameter 'u_id' in /admin/users.php and the POST parameter 'agent[]' in /admin/mailer.php. Attackers can exploit time-based blind SQL injection techniques to extract sensitive database information or cause denial of service through sleep-based payloads.
Affected products
2- Range: =4.0.2
- Next Click Ventures/RealtyScriptsv5Range: 4.0.2
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
3- www.exploit-db.com/exploits/38497mitreexploit
- www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5270.phpmitrevendor-advisory
- www.vulncheck.com/advisories/realtyscript-sql-injection-via-u-id-and-agent-parametersmitrethird-party-advisory
News mentions
0No linked articles in our index yet.