An SQL injection flaw in the search.php file of itsourcecode Real Estate Management System 1.0 allows an attacker to inject arbitrary SQL statements through the search, delivery_type, search_price, and property_type query parameters. The flaw stems from inadequate input validation (CWE‑74) and the use of unsanitized user input in SQL statements (CWE‑89). If exploited, the attacker can read, modify or delete data in the application's database, potentially exposing sensitive real‑estate listings, customer information, or other confidential data.

Affected systems include any deployment of itsourcecode Real Estate Management System version 1.0 or earlier that has the search.php script.

The CVSS base score of 6.9 indicates moderate severity, and the lack of an EPSS score suggests limited but possible exploitation activity. Because the vulnerability is triggered by remote HTTP requests and the exploit code is publicly available, an attacker with Internet access could potentially gain unauthorized data access. The lack of KEV listing does not diminish the risk; the flaw remains unpatched and publicly exploitable.