The vulnerability is a classic SQL injection that originates from improper handling of the Username argument within /loginuser.php of the Login component. An attacker can manipulate this parameter to inject arbitrary SQL, potentially reading, modifying, or deleting data in the backend database. This flaw allows remote exploitation, meaning that a malicious actor can target the application over the internet without requiring local privileges. The impact is that the confidentiality, integrity, and availability of the application’s data may be compromised, leading to data leakage, unauthorized access, or disruptions.

The affected product is code-projects Real State Services version 1.0. No other versions or vendor products are listed as impacted.

The CVSS score of 6.9 categorizes this flaw as medium severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting that it has not yet been widely abused. However, the description indicates that the exploit has been publicly disclosed and may be used by attackers. The likely attack vector is remote over the web interface, specifically targeting the login page that accepts user credentials.