CVE-2015-20121

CRITICO 9.8CVE-2015-20121 · Published 16/03/2026 · updated 17/06/2026

Package	Affected versions	Patched versions
realtyscript nextclickventures	`= 4.0.2`	No fix yet

Description

Next Click Ventures RealtyScript 4.0.2 contains SQL injection vulnerabilities that allow unauthenticated attackers to manipulate database queries by injecting arbitrary SQL code through the GET parameter 'u_id' in /admin/users.php and the POST parameter 'agent[]' in /admin/mailer.php. Attackers can exploit time-based blind SQL injection techniques to extract sensitive database information or cause denial of service through sleep-based payloads.

References

zeroscience.mk/en/vulnerabilities/ZSL-2015-5270.php · Exploit
exploit-db.com/exploits/38497 · Exploit
vulncheck.com/advisories/realtyscript-sql-injection-via-u-id-and-agent-parameters · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free