CVE-2015-20115

HIGH

RealtyScript 4.0.2 Stored Cross-Site Scripting via File Upload Parameter

Title source: cna
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2015-20115. PoCs published by LiquidWorm.

AI-analyzed exploit summary The exploit demonstrates multiple CSRF and stored XSS vulnerabilities in RealtyScript v4.0.2. It includes functional PoC code for uploading malicious CSV files, adding users, creating superusers, and injecting XSS payloads via various parameters.

Description

Next Click Ventures RealtyScript 4.0.2 fails to properly sanitize file uploads, allowing attackers to store malicious scripts through the file POST parameter in admin/tools.php. Attackers can upload files containing JavaScript code that executes in the context of admin/tools.php when accessed by other users.

Exploits (1)

exploitdb WORKING POC
by LiquidWorm · textwebappsphp
https://www.exploit-db.com/exploits/38496

The exploit demonstrates multiple CSRF and stored XSS vulnerabilities in RealtyScript v4.0.2. It includes functional PoC code for uploading malicious CSV files, adding users, creating superusers, and injecting XSS payloads via various parameters.

Classification
Working Poc 100%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: RealtyScript v4.0.2
Auth required
Prerequisites: Admin session cookies · Target URL
devstral-2 · analyzed Mar 16, 2026 Full analysis →

References (3)

Core 3
Core References
Exploit exploit
ExploitDB-38496
https://www.exploit-db.com/exploits/38496
Third Party Advisory third-party-advisory
Zero Science Lab Disclosure
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5269.php
Third Party Advisory third-party-advisory
VulnCheck Advisory: RealtyScript 4.0.2 Stored Cross-Site Scripting via File Upload Parameter
https://www.vulncheck.com/advisories/realtyscript-stored-cross-site-scripting-via-file-upload-parameter

Scores

CVSS v3 7.2
EPSS 0.0027
EPSS Percentile 18.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (2)
Next Click Ventures/RealtyScript 4.0.2
nextclickventures/realtyscript 4.0.2
Published Mar 16, 2026
Tracked Since Mar 16, 2026