CVE-2015-20121 - CVE House

Back to Database

Status published High CVE-2015-20121

RealtyScript 4.0.2 SQL Injection via u_id and agent Parameters

8.8 CVSS

Vulnerability Description

Next Click Ventures RealtyScript 4.0.2 contains SQL injection vulnerabilities that allow unauthenticated attackers to manipulate database queries by injecting arbitrary SQL code through the GET parameter 'u_id' in /admin/users.php and the POST parameter 'agent[]' in /admin/mailer.php. Attackers can exploit time-based blind SQL injection techniques to extract sensitive database information or cause denial of service through sleep-based payloads.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2015-20121

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from Next Click Ventures

View All →

RealtyScript 4.0.2 Multiple Time-based Blind SQL Injection

RealtyScript 4.0.2 Stored Cross-Site Scripting via text Parameter in pages.php

RealtyScript 4.0.2 Stored Cross-Site Scripting via location_name Parameter

RealtyScript 4.0.2 Cross-Site Request Forgery Unauthorized User Creation

RealtyScript 4.0.2 Stored Cross-Site Scripting via CSV File Upload Filename

Affected Vendor

Next Click Ventures

View all reports →

Affected Software

RealtyScripts

Vulnerable Versions:

4.0.2

Timeline

Official Publish: March 15th, 2026

Last Modified: March 16th, 2026

Added to House: July 19th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1059 Command and Scripting Interpreter

T1213.006 Databases

T1485 Data Destruction