The vulnerability exists in the /pay.php page of code‑projects Real State Services 1.0, where user‑supplied data supplied in the Bankname parameter is incorporated directly into a SQL statement without proper sanitization or parameterization. This permits an attacker to inject arbitrary SQL code that will be executed by the database engine, enabling unauthorized read, modification, or deletion of data stored in the backend database and thereby compromising confidentiality, integrity and potentially availability of the system’s data.

code‑projects Real State Services version 1.0 is the only product identified as affected. The specific vulnerable component is the /pay.php endpoint, which accepts a Bankname argument that can be exploited as described.

The CVSS score of 6.9 indicates moderate severity, while an EPSS score of <1% suggests that the vulnerability is currently unlikely to be widely exploited. The vulnerability is not listed in CISA KEV. The attack vector is remote – an unauthenticated HTTP request to /pay.php that manipulates the Bankname parameter can trigger the exploit. Because the flaw is publicly disclosed and the target site is exposed to the internet, it poses a real threat to any deployed instance that has not applied a fix.