The vulnerability is a classic SQL injection that stems from unsanitized handling of the 'loc' argument in the file builderHome.php. By injecting malicious SQL fragments, an attacker can read, modify, or delete data stored in the application database, potentially compromising confidentiality and integrity. The flaw is recorded as CWE-74 and CWE-89 and is exploitable from a remote location.

The affected product is code-projects Real State Services version 1.0. The vulnerable code resides in builderHome.php, and no other versions or patch information are documented in the CVE data.

With a CVSS score of 6.9 the issue is considered moderate in severity, while the EPSS score of <1% indicates a low overall likelihood of active exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed widespread exploitation yet. Based on the description, it is inferred that no explicit authentication is required, implying that the attack can be carried out remotely without prior credentials.