Netartmedia PHP Real Estate Agency 4.0 includes an SQL injection flaw in the features[] parameter within index.php. The unvalidated user input allows an unauthenticated attacker to inject arbitrary SQL code, which can be used to read sensitive database content or modify records. This vulnerability is classified as CWE-89 and can compromise the confidentiality and integrity of the application’s data.

Affected systems are instances of Netartmedia PHP Real Estate Agency version 4.0. No other affected versions are listed in the data provided.

The CVSS score of 8.8 indicates a high severity, while the EPSS score of less than 1% suggests a low probability of current exploitation. The vulnerability is not part of the CISA Known Exploited Vulnerabilities catalog. Attackers can exploit the flaw by sending unauthenticated POST requests to index.php with crafted SQL payloads in the features[] parameter, taking advantage of the lack of input sanitization to gain database access.