CVE-2015-20117
Published: 16 March 2026
Description
Next Click Ventures RealtyScript 4.0.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create unauthorized user accounts and administrative users by crafting malicious forms. Attackers can submit hidden form data to /admin/addusers.php and /admin/editadmins.php endpoints to register…
more
new users with arbitrary credentials and escalate privileges to SUPERUSER level.
Mitigating Controls (NIST 800-53 r5)AI
SC-23 requires mechanisms to protect session authenticity, such as CSRF tokens, directly preventing forged requests to /admin/addusers.php and /admin/editadmins.php endpoints.
SI-10 mandates validation of information inputs, including CSRF tokens and form data, to block malicious submissions that create unauthorized users.
AC-2 enforces account management processes, including approval and review of new accounts, to prevent, identify, and disable unauthorized SUPERUSER accounts created via CSRF.
Security SummaryAI
CVE-2015-20117 is a cross-site request forgery (CSRF) vulnerability, classified under CWE-352, in Next Click Ventures RealtyScript version 4.0.2. The flaw resides in the /admin/addusers.php and /admin/editadmins.php endpoints, which lack proper CSRF protections, enabling attackers to submit hidden form data for unauthorized actions.
Unauthenticated attackers can exploit this vulnerability over the network with low complexity and no privileges required, as indicated by its CVSS v3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). By crafting malicious forms, they can trick victims into creating new user accounts with arbitrary credentials or escalate privileges to SUPERUSER level, potentially gaining administrative control.
Advisories detailing the issue include Exploit-DB (https://www.exploit-db.com/exploits/38496), VulnCheck (https://www.vulncheck.com/advisories/realtyscript-cross-site-request-forgery-unauthorized-user-creation), and Zero Science (https://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5269.php). No patch or mitigation details are specified in the CVE description.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CSRF vulnerability in public-facing web application admin endpoints enables unauthenticated remote exploitation to create accounts or escalate privileges, directly mapping to T1190: Exploit Public-Facing Application.