CVE-2019-25479 - Vulnerability Analysis

Overview

Inout RealEstate contains an sql_injection caused by unsanitized input in the city parameter at agents/agentlistdetails endpoint, letting unauthenticated attackers extract sensitive database information remotely, exploit requires crafted POST requests.

Severity & Score

Impact

Unauthenticated attackers can extract sensitive database information, leading to data disclosure and potential further compromise.

Mitigation

Update to the latest version with SQL injection fixes.

References

• https://www.exploit-db.com/exploits/46631
• https://www.vulncheck.com/advisories/inout-realestate-lastest-sql-injection-via-agentlistdetails

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner