Cross-Site Request Forgery Vulnerability in Next Click Ventures RealtyScript
CVE-2015-20117

6.9MEDIUM

Key Information:

Vendor

Next Click Ventures

Status
Realtyscript
Vendor
CVE Published:
15 March 2026

Badges

👾 Exploit Exists

What is CVE-2015-20117?

RealtyScript 4.0.2 is susceptible to a cross-site request forgery vulnerability, enabling attackers to create unauthorized user accounts and even grant administrative privileges. By manipulating hidden form data submitted to critical endpoints such as /admin/addusers.php and /admin/editadmins.php, attackers can forge requests that register new users with arbitrary credentials. This flaw poses significant risks, as it allows unverified individuals to escalate their access level to SUPERUSER, compromising the integrity and security of the application.

Affected Version(s)

RealtyScript 4.0.2

References

https://www.exploit-db.com/exploits/38496
exploit
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-52...
third-party-advisory
https://www.vulncheck.com/advisories/realtyscript-cross-s...
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.