CVE-2015-20117
Published: 16 March 2026
Summary
CVE-2015-20117 is a medium-severity CSRF (CWE-352) vulnerability in Nextclickventures Realtyscript. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 9.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2015-20117 is a cross-site request forgery (CSRF) vulnerability, classified under CWE-352, in Next Click Ventures RealtyScript version 4.0.2. The flaw resides in the /admin/addusers.php and /admin/editadmins.php endpoints, which lack proper CSRF protections, enabling attackers to submit hidden form data for unauthorized actions.
Unauthenticated attackers can exploit this vulnerability over the network with low complexity and no privileges required, as indicated by its CVSS v3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). By crafting malicious forms, they can trick victims into creating new user accounts with arbitrary credentials or escalate privileges to SUPERUSER level, potentially gaining administrative control.
Advisories detailing the issue include Exploit-DB (https://www.exploit-db.com/exploits/38496), VulnCheck (https://www.vulncheck.com/advisories/realtyscript-cross-site-request-forgery-unauthorized-user-creation), and Zero Science (https://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5269.php). No patch or mitigation details are specified in the CVE description.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2015-9415
Vulnerability details
Next Click Ventures RealtyScript 4.0.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create unauthorized user accounts and administrative users by crafting malicious forms. Attackers can submit hidden form data to /admin/addusers.php and /admin/editadmins.php endpoints to register…
more
new users with arbitrary credentials and escalate privileges to SUPERUSER level.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CSRF vulnerability in public-facing web application admin endpoints enables unauthenticated remote exploitation to create accounts or escalate privileges, directly mapping to T1190: Exploit Public-Facing Application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SC-23 requires mechanisms to protect session authenticity, such as CSRF tokens, directly preventing forged requests to /admin/addusers.php and /admin/editadmins.php endpoints.
SI-10 mandates validation of information inputs, including CSRF tokens and form data, to block malicious submissions that create unauthorized users.
AC-2 enforces account management processes, including approval and review of new accounts, to prevent, identify, and disable unauthorized SUPERUSER accounts created via CSRF.