CVE-2019-25536 - Netartmedia PHP Real Estate Agency 4.0 SQL Injection via features parameter

Back Back to CVE browser

HIGH

Netartmedia PHP Real Estate Agency 4.0 SQL Injection via features parameter

Published Mar 12, 2026

8.8

HIGH

CVSS 4.0

EPSS 0.32%

Description

Netartmedia PHP Real Estate Agency 4.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the features[] parameter. Attackers can send POST requests to index.php with crafted SQL payloads in the features[] parameter to extract sensitive database information or manipulate database queries.

Affected products

Vendor Netartmedia Product Netartmedia PHP Real Estate Agency Default
n/a
- Version
  4.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Netartmedia

Netartmedia PHP Real Estate Agency

n/a

Version	Status	Constraints
4.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-89

SQL Injection

References (2)

https://www.exploit-db.com/exploits/46574
exploitVDB Entry
https://www.vulncheck.com/advisories/netartmedia-php-real-estate-agency-sql-injection-via-features-parameter
third-party-advisoryThird Party Advisory

Link	Providers	Tags
https://www.exploit-db.com/exploits/46574		exploitVDB Entry
https://www.vulncheck.com/advisories/netartmedia-php-real-estate-agency-sql-injection-via-features-parameter		third-party-advisoryThird Party Advisory