Relative Real Estate Systems SQL Injection Vulnerability

Bugtraq ID:	15714
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 05 2005 12:00AM
Updated:	Dec 05 2005 12:00AM
Credit:	Discovered by r0t3d3Vil.
Vulnerable:	Relative Real Estate Systems Relative Real Estate Systems 1.2
Not Vulnerable:

Relative Real Estate Systems SQL Injection Vulnerability

Relative Real Estate Systems is prone to an SQL injection vulnerability.

This issue is due to a failure in the application to properly sanitize user-supplied input to the 'index.php' script before using it in an SQL query.

This vulnerability could permit remote attackers to pass malicious input to database queries, resulting in modification of query logic or other attacks.

Relative Real Estate Systems SQL Injection Vulnerability

No exploit is required.

The following proof of concept example is available:
http://www.example.com/index.php?name=&price_from=&price_to=&city=&state=SC&mls=[SQL]&bathroom=-1&bedrooms=-1&go=search&results=1

Relative Real Estate Systems SQL Injection Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Relative Real Estate Systems SQL Injection Vulnerability

References:

• Relative Real Estate Systems Product Page (Relative Real Estate Systems)
  
• Relative Real Estate Systems SQL inj. vuln. (rakstija r0t3d3Vil)