An unauthenticated attacker can send crafted POST requests to the agents/agentlistdetails endpoint and inject SQL code through the city parameter. This allows the attacker to modify database queries and retrieve sensitive database information, such as user data or configuration values. The vulnerability is a classic SQL injection (CWE-89) and can compromise data confidentiality and integrity.

The affected product is Inout RealEstate from the vendor Inoutscripts. No specific version information is provided.

The CVSS score is 8.8 indicating a high severity. The EPSS score is below 1%, suggesting low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an unauthenticated HTTP POST request to the /agents/agentlistdetails endpoint with a malicious city parameter; this inference is based on the description of the attack surface.