EUVD-2015-9407Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
4DescriptionCVE.org
Next Click Ventures RealtyScript 4.0.2 contains cross-site request forgery and persistent cross-site scripting vulnerabilities that allow attackers to perform administrative actions and inject malicious scripts. Attackers can craft malicious web pages that execute unauthorized actions when logged-in users visit them, or inject persistent scripts that execute in the application context.
AnalysisAI
RealtyScript 4.0.2 by Next Click Ventures contains both cross-site request forgery (CSRF) and persistent cross-site scripting (XSS) vulnerabilities that allow unauthenticated attackers to perform unauthorized administrative actions and inject malicious scripts into the application. An attacker can craft malicious web pages that trick authenticated users into performing unintended administrative actions, or inject persistent scripts that execute in the application context for all users. With a CVSS score of 5.3 and a network-based attack vector requiring no privileges or user interaction beyond initial application access, this represents a moderate integrity risk to affected deployments.
Technical ContextAI
The vulnerability chain exploits two distinct web application security flaws rooted in inadequate input validation and request authentication mechanisms. The CSRF vulnerability (CWE-352: Cross-Site Request Forgery) stems from the application's failure to implement proper anti-CSRF tokens or Same-Site cookie attributes, allowing attackers to forge requests that execute administrative functions when authenticated users visit malicious pages. The persistent XSS component indicates insufficient output encoding or sanitization of user-supplied input stored in the application database, causing malicious scripts to be reflected back to all users who access affected pages. RealtyScript 4.0.2 (CPE specification: cpe:2.3:a:next_click_ventures:realtyscript:4.0.2:*:*:*:*:*:*:*) appears to lack modern web security controls such as Content Security Policy (CSP) headers, CSRF token validation, and HTML entity encoding, making it vulnerable to both request forgery and script injection attacks.
RemediationAI
The primary remediation is to upgrade RealtyScript to a patched version released by Next Click Ventures; organizations should contact the vendor immediately to confirm patch availability and version numbers for version 4.0.3 or later. If patching is not immediately available, implement the following interim controls: (1) Deploy a Web Application Firewall (WAF) configured to detect and block CSRF attacks (enforce token validation rules) and XSS payloads (HTMLEntity encoding filters); (2) Enforce HTTPS-only communication with HSTS (Strict-Transport-Security) headers to prevent man-in-the-middle exploitation; (3) Implement Content Security Policy (CSP) headers restricting script execution to trusted sources only, mitigating reflected and stored XSS; (4) Apply HTML entity encoding to all user-supplied input rendered in responses; (5) Restrict administrative access to trusted IP ranges via firewall rules to reduce CSRF attack surface; (6) Implement SameSite=Strict cookie attributes on session cookies to block CSRF vector; (7) Conduct a forensic audit of logs and user accounts for signs of prior exploitation. Contact Next Click Ventures support for guidance on patch testing and deployment timelines.
Share
External POC / Exploit Code
Leaving vuln.today