CVE-2015-20117 - CVE House
Back to Database
Status published Medium CVE-2015-20117

RealtyScript 4.0.2 Cross-Site Request Forgery Unauthorized User Creation

Vulnerability Description

Next Click Ventures RealtyScript 4.0.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create unauthorized user accounts and administrative users by crafting malicious forms. Attackers can submit hidden form data to /admin/addusers.php and /admin/editadmins.php endpoints to register new users with arbitrary credentials and escalate privileges to SUPERUSER level.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2015-20117

Credits & Attribution

No credits recorded in the NVD database.

References

More from Next Click Ventures

View All →
CVE-2015-20121
RealtyScript 4.0.2 SQL Injection via u_id and agent Parameters
High 8.8
CVE-2015-20120
RealtyScript 4.0.2 Multiple Time-based Blind SQL Injection
High 8.8
CVE-2015-20119
RealtyScript 4.0.2 Stored Cross-Site Scripting via text Parameter in pages.php
Medium 5.1
CVE-2015-20118
RealtyScript 4.0.2 Stored Cross-Site Scripting via location_name Parameter
Medium 5.1
CVE-2015-20116
RealtyScript 4.0.2 Stored Cross-Site Scripting via CSV File Upload Filename
Medium 5.1

Affected Vendor

Next Click Ventures

View all reports →

Affected Software

RealtyScript
Vulnerable Versions:
4.0.2

Timeline

Official Publish: March 15th, 2026
Last Modified: March 16th, 2026
Added to House: July 19th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weaknesses (CWE)

CWE-352

MITRE ATT&CK TTPs

T1566.002 Spearphishing Link
Initial Access
T1204.001 Malicious Link
Execution
T1098 Account Manipulation
Persistence
T1565.001 Stored Data Manipulation
Impact