CVE-2015-20120
Time-Based Blind SQL Injection in RealtyScript 4.0.2 Allows Data Extraction
Publication date: 2026-03-16
Last updated on: 2026-03-19
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| nextclickventures | realtyscript | 4.0.2 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': "CVE-2015-20120 is a vulnerability in RealtyScript version 4.0.2 caused by multiple time-based blind SQL injection flaws. These occur because certain input parameters, specifically the GET parameter 'u_id' and the POST parameter 'agent[]', are not properly sanitized before being used in SQL queries. This improper input validation allows unauthenticated attackers to inject arbitrary SQL code into the application."}, {'type': 'paragraph', 'content': 'Attackers exploit this by sending specially crafted requests containing time-delay payloads. By measuring the differences in response times, they can infer the contents of the database character by character without directly seeing the data.'}] [1, 2, 3]
How can this vulnerability impact me? :
This vulnerability can have serious impacts including unauthorized extraction of sensitive database information and potential manipulation of data. Attackers can use the time-based blind SQL injection to retrieve confidential system and user data without authentication.
Additionally, the injection can be used to cause denial of service by introducing delays in the database responses. The overall risk is rated high, with a CVSS v4 score of 8.8, indicating a significant threat to confidentiality and partial impact on integrity.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': "This vulnerability can be detected by testing the GET parameter 'u_id' and the POST parameter 'agent[]' for time-based blind SQL injection. Attackers or testers can craft requests that include SQL time-delay payloads such as the MySQL SLEEP() function to observe response timing differences."}, {'type': 'paragraph', 'content': "One practical method is to use sqlmap, an automated SQL injection tool, which has been confirmed to identify the 'u_id' parameter as vulnerable to time-based blind SQL injection on a MySQL (MariaDB) backend."}, {'type': 'paragraph', 'content': 'Example commands include:'}, {'type': 'list_item', 'content': 'Using sqlmap to test the GET parameter \'u_id\':\nsqlmap -u "http://targetsite/admin/users.php?u_id=1" --risk=3 --level=5 --dbms=mysql --technique=T'}, {'type': 'list_item', 'content': 'Manually testing with curl by injecting a time delay payload in the \'u_id\' parameter:\ncurl "http://targetsite/admin/users.php?u_id=1 AND SLEEP(5)" -v -m 10'}, {'type': 'list_item', 'content': 'Testing the POST parameter \'agent[]\' with a crafted payload using curl:\ncurl -X POST -d "agent[]=1 AND SLEEP(5)" http://targetsite/admin/mailer.php -v -m 10'}] [3]
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': 'Immediate mitigation steps include:'}, {'type': 'list_item', 'content': "Implement proper input validation and sanitization on all user-supplied parameters, especially 'u_id' and 'agent[]', to prevent SQL injection."}, {'type': 'list_item', 'content': 'Use parameterized queries or prepared statements in the application code to safely handle SQL queries.'}, {'type': 'list_item', 'content': "Restrict direct access to vulnerable endpoints such as '/admin/users.php' and '/admin/mailer.php' by applying authentication and authorization controls."}, {'type': 'list_item', 'content': 'If possible, update or patch RealtyScript to a version that addresses these vulnerabilities.'}, {'type': 'list_item', 'content': 'Monitor logs and network traffic for suspicious requests containing SQL injection payloads or unusual delays.'}] [1, 3]