CVE-2015-20113

MEDIUM

RealtyScript 4.0.2 Multiple Cross-Site Request Forgery and Persistent Cross-Site Scripting Vulnerabilities

Title source: cna

Exploitation Summary

EIP tracks 1 public exploit for CVE-2015-20113. PoCs published by LiquidWorm.

AI-analyzed exploit summary The exploit demonstrates multiple CSRF and stored XSS vulnerabilities in RealtyScript v4.0.2, including user addition, privilege escalation to SUPERUSER, and persistent XSS via file upload and form parameters.

Description

Next Click Ventures RealtyScript 4.0.2 contains cross-site request forgery and persistent cross-site scripting vulnerabilities that allow attackers to perform administrative actions and inject malicious scripts. Attackers can craft malicious web pages that execute unauthorized actions when logged-in users visit them, or inject persistent scripts that execute in the application context.

Exploits (1)

exploitdb WORKING POC

by LiquidWorm · textwebappsphp

https://www.exploit-db.com/exploits/38496

View Code ZIP pw:eip

The exploit demonstrates multiple CSRF and stored XSS vulnerabilities in RealtyScript v4.0.2, including user addition, privilege escalation to SUPERUSER, and persistent XSS via file upload and form parameters.

Classification

Working Poc 100%

Attack Type

Xss | Auth Bypass

Complexity

Trivial

Reliability

Reliable

Target: RealtyScript v4.0.2

Auth required

Prerequisites: Admin session cookies for CSRF attacks · Access to admin interfaces

MITRE ATT&CK

T1059.007 - JavaScript T1189 - Drive-by Compromise T1190 - Exploit Public-Facing Application T1078 - Valid Accounts

devstral-2 · analyzed Mar 16, 2026 Full analysis →

References (3)

Core 3

Core References

Exploit exploit

ExploitDB-38496

https://www.exploit-db.com/exploits/38496

Third Party Advisory third-party-advisory

Zero Science Lab Disclosure

https://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5269.php

Third Party Advisory third-party-advisory

VulnCheck Advisory: RealtyScript 4.0.2 Multiple Cross-Site Request Forgery and Persistent Cross-Site Scripting Vulnerabilities

https://www.vulncheck.com/advisories/realtyscript-multiple-cross-site-request-forgery

Scores

CVSS v3 5.3

EPSS 0.0018

EPSS Percentile 7.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact partial

Details

CWE

CWE-352

Status published

Products (2)

Next Click Ventuers/RealtyScript 4.0.2

nextclickventures/realtyscript 4.0.2

Published Mar 16, 2026

Tracked Since Mar 16, 2026