CVE-2015-20117

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2015-20117
Next Click Ventures RealtyScript 4.0.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create unauthorized user accounts and administrative users by crafting malicious forms. Attackers can submit hidden form data to /admin/addusers.php and /admin/editadmins.php endpoints to register new users with arbitrary credentials and escalate privileges to SUPERUSER level.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://www.exploit-db.com/exploits/38496 Exploit Third Party Advisory VDB Entry
https://www.vulncheck.com/advisories/realtyscript-cross-site-request-forgery-unauthorized-user-creation Third Party Advisory
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5269.php Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:nextclickventures:realtyscript:4.0.2:*:*:*:*:*:*:*
History

19 Mar 2026, 14:13

Type Values Removed Values Added
References () https://www.exploit-db.com/exploits/38496 - () https://www.exploit-db.com/exploits/38496 - Exploit, Third Party Advisory, VDB Entry
References () https://www.vulncheck.com/advisories/realtyscript-cross-site-request-forgery-unauthorized-user-creation - () https://www.vulncheck.com/advisories/realtyscript-cross-site-request-forgery-unauthorized-user-creation - Third Party Advisory
References () https://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5269.php - () https://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5269.php - Third Party Advisory
First Time Nextclickventures realtyscript
Nextclickventures
Summary
  • (es) Next Click Ventures RealtyScript 4.0.2 contiene una vulnerabilidad de falsificación de petición en sitios cruzados que permite a atacantes no autenticados crear cuentas de usuario no autorizadas y usuarios administrativos mediante la creación de formularios maliciosos. Los atacantes pueden enviar datos de formulario ocultos a los puntos finales /admin/addusers.PHP y /admin/editadmins.PHP para registrar nuevos usuarios con credenciales arbitrarias y escalar privilegios a nivel SUPERUSER.
CPE cpe:2.3:a:nextclickventures:realtyscript:4.0.2:*:*:*:*:*:*:*

16 Mar 2026, 14:17

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-16 14:17

Updated : 2026-03-19 14:13

NVD link : CVE-2015-20117

Mitre link : CVE-2015-20117

CVE.ORG link : CVE-2015-20117

JSON object : View

Products Affected

nextclickventures

  • realtyscript
CWE
CWE-352

Cross-Site Request Forgery (CSRF)