Blind SQL Injection Vulnerabilities in RealtyScript by Next Click Ventures
CVE-2015-20120

8.8HIGH

Key Information:

Vendor

Next Click Ventures

Status
Realtyscript
Vendor
CVE Published:
15 March 2026

Badges

👾 Exploit Exists

What is CVE-2015-20120?

RealtyScript 4.0.2 by Next Click Ventures is vulnerable to multiple time-based blind SQL injection flaws. These vulnerabilities enable unauthorized individuals to extract sensitive database information by injecting malicious SQL code into application parameters. Attackers can exploit these flaws by crafting specialized requests that leverage time-delay payloads, allowing them to infer database contents character by character through discrepancies in response timing. This type of attack poses significant risks to data confidentiality and integrity.

Affected Version(s)

RealtyScript 4.0.2

References

https://www.exploit-db.com/exploits/38497
exploit
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-52...
third-party-advisory
https://www.vulncheck.com/advisories/realtyscript-multipl...
third-party-advisory

CVSS V4

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.