CVE-2015-20117: RealtyScript CSRF Vulnerability

CVE-2015-20117 Overview

Next Click Ventures RealtyScript 4.0.2 contains a cross-site request forgery (CSRF) vulnerability that allows unauthenticated attackers to create unauthorized user accounts and administrative users by crafting malicious forms. Attackers can submit hidden form data to /admin/addusers.php and /admin/editadmins.php endpoints to register new users with arbitrary credentials and escalate privileges to SUPERUSER level.

Critical Impact

Attackers can exploit this CSRF vulnerability to create administrative accounts without authentication, potentially gaining full control over the RealtyScript application and its underlying data.

Affected Products

• Next Click Ventures RealtyScript 4.0.2
• Nextclickventures Realtyscript (all versions prior to patched releases)

Discovery Timeline

• 2026-03-16 - CVE CVE-2015-20117 published to NVD
• 2026-03-19 - Last updated in NVD database

Technical Details for CVE-2015-20117

Vulnerability Analysis

This vulnerability is classified as CWE-352 (Cross-Site Request Forgery), a web application security flaw where the application fails to verify that authenticated requests originate from the legitimate user. In RealtyScript 4.0.2, the administrative endpoints responsible for user and administrator management do not implement proper anti-CSRF tokens or request validation mechanisms.

The vulnerable endpoints /admin/addusers.php and /admin/editadmins.php accept form submissions without verifying the request's origin or including any challenge tokens. This allows an attacker to craft a malicious webpage containing hidden form fields that, when visited by an authenticated administrator, automatically submits requests to create new user accounts or modify existing administrative privileges.

Root Cause

The root cause of this vulnerability is the absence of CSRF protection mechanisms in the administrative user management functionality. The application does not implement:

• Anti-CSRF tokens in form submissions
• Referrer header validation
• Same-origin policy enforcement for state-changing operations
• Request authentication beyond session cookies

Attack Vector

The attack is network-based and requires user interaction where an authenticated administrator must visit a malicious webpage or click a crafted link. The attacker constructs an HTML page containing hidden forms that target the vulnerable endpoints. When the victim administrator loads this page, JavaScript automatically submits the form, creating unauthorized accounts with the administrator's existing session authentication.

The attack flow involves:

1. Attacker creates a malicious webpage with hidden form fields targeting /admin/addusers.php or /admin/editadmins.php
2. The form contains parameters for creating a new user with attacker-controlled credentials
3. Victim administrator visits the malicious page while authenticated to RealtyScript
4. The browser automatically submits the form using the administrator's session
5. A new user account or administrative user is created without the administrator's knowledge

For detailed technical exploitation information, refer to the Zero Science Vulnerability ZSL-2015-5269 advisory and Exploit-DB #38496.

Detection Methods for CVE-2015-20117

Indicators of Compromise

• Unexpected user accounts appearing in the RealtyScript administrative panel
• New administrative users created without legitimate administrator action
• Web server logs showing POST requests to /admin/addusers.php or /admin/editadmins.php with unusual referrer headers
• Multiple account creation events within a short timeframe from different source IPs

Detection Strategies

• Monitor web server access logs for POST requests to /admin/addusers.php and /admin/editadmins.php endpoints with external referrer headers
• Implement alerting for new user account creation events, especially those with administrative privileges
• Review audit logs for user creation timestamps that don't correlate with expected administrative activity
• Deploy web application firewalls (WAF) with CSRF detection capabilities to identify suspicious cross-origin requests

Monitoring Recommendations

• Enable detailed access logging on the web server to capture referrer headers and request origins
• Configure alerts for administrative account modifications or creations outside of business hours
• Implement session monitoring to detect simultaneous administrative actions from different geographic locations
• Regularly audit user account lists and administrative privilege assignments for unauthorized entries

How to Mitigate CVE-2015-20117

Immediate Actions Required

• Restrict access to administrative endpoints (/admin/) to trusted IP addresses only using firewall rules or web server configuration
• Implement network-level access controls to limit who can reach the RealtyScript administrative interface
• Review and audit all existing user accounts and administrative users for unauthorized entries
• Consider taking the administrative interface offline until proper CSRF protections can be implemented

Patch Information

No vendor patch information is currently available in the CVE data. Organizations should contact Next Click Ventures directly for updated software versions or consider implementing custom CSRF protection mechanisms. For additional advisory details, see the VulnCheck Security Advisory.

Workarounds

• Implement a web application firewall (WAF) rule to block requests to administrative endpoints with external referrer headers
• Add custom CSRF token validation to the affected PHP scripts if source code modification is possible
• Require re-authentication or CAPTCHA verification for sensitive administrative actions
• Use browser extensions or configurations that block cross-origin form submissions while performing administrative tasks

Example Apache configuration to restrict administrative access by IP:

# Restrict admin directory access to trusted IPs
<Directory "/var/www/html/admin">
    Order deny,allow
    Deny from all
    Allow from 192.168.1.0/24
    Allow from 10.0.0.0/8
</Directory>