PHP CVE-2015-20117

The vulnerability is rooted in CWE-352 (Cross-Site Request Forgery), a class of attacks where an application fails to validate that state-changing requests originate from the legitimate user rather than from an attacker-controlled source. RealtyScript 4.0.2, a property management/real estate application developed by Next Click Ventures, implements administrative user management functions in /admin/addusers.php and /admin/editadmins.php without implementing anti-CSRF protections such as cryptographic tokens, SameSite cookie attributes, or referer validation. The affected product is specifically identified under the real estate software category. When a user with administrative privileges visits a malicious webpage, the browser automatically includes session cookies in requests to the RealtyScript domain, allowing the attacker to perform privileged actions such as creating SUPERUSER accounts without the administrator's knowledge or consent. The lack of request origin validation means the application processes form submissions regardless of their true source, making this a classic POST-based CSRF attack vector.