Inout RealEstate SQL Injection Vulnerability

A SQL injection vulnerability has been identified in Inout RealEstate, allowing unauthenticated attackers to manipulate database queries. The vulnerability arises from the 'city' parameter, which can be exploited by sending POST requests to the 'agents/agentlistdetails' endpoint with injected SQL payloads. This exploitation could lead to the extraction of sensitive information from the database.

Impact

Exploitation of this vulnerability allows for unauthorized manipulation of database queries, potentially leading to the extraction of sensitive database information.

Reproduction

To reproduce this vulnerability, send a POST request to the 'agents/agentlistdetails' endpoint. Include a malicious SQL payload in the 'city' parameter. The injected SQL code can be crafted to manipulate the database query and extract sensitive information.