CVE-2015-20120 - Vulnerability Analysis

Overview

Next Click Ventures RealtyScript 4.0.2 contains multiple time-based blind SQL injection vulnerabilities caused by unsanitized input in application parameters, letting unauthenticated attackers extract database information via time-delay payloads.

Severity & Score

Impact

Unauthenticated attackers can extract sensitive database information, potentially compromising the entire database.

Mitigation

Update to the latest version of RealtyScript.

References

• https://www.exploit-db.com/exploits/38497
• https://www.vulncheck.com/advisories/realtyscript-multiple-time-based-blind-sql-injection
• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5270.php

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner