CVE-2017-15991

Critical

Published: 31/10/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

Vastal I-Tech Agent Zone (also known as The Real Estate Script) allows SQL Injection in searchCommercial.php via the property_type, city, or posted_by parameter, and in searchResidential.php via the property_type, city, or bedroom parameter.

Risk Assessment

Exploitation of this vulnerability may lead to unauthorized access to the database, threatening the integrity and confidentiality of the organization's data.

Recommendation

It is recommended to update the script to the latest version and implement input filtering and validation to minimize the risk of SQL Injection attacks.

Original NVD description (English source)

Vastal I-Tech Agent Zone (aka The Real Estate Script) allows SQL Injection in searchCommercial.php via the property_type, city, or posted_by parameter, or searchResidential.php via the property_type, city, or bedroom parameter, a different vulnerability than CVE-2008-3951, CVE-2009-3497, and CVE-2012-0982.