VulnerabilityAnalyzed
CVE-2015-20115
Next Click Ventures RealtyScript 4.0.2 fails to properly sanitize file uploads, allowing attackers to store malicious scripts through the file POST parameter in admin/tools.php.
MEDIUM 5.1EPSS 0.27%
Does this matter?
Lower severity and a low EPSS score (0.27%). Track it; it rarely justifies an emergency change on its own.
Description
Next Click Ventures RealtyScript 4.0.2 fails to properly sanitize file uploads, allowing attackers to store malicious scripts through the file POST parameter in admin/tools.php. Attackers can upload files containing JavaScript code that executes in the context of admin/tools.php when accessed by other users.
- CVSS 4.0
- 5.1 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.27% probability · 19th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- nextclickventures/realtyscript
- Source
- disclosure@vulncheck.com
References
- https://www.exploit-db.com/exploits/38496Exploit, Third Party Advisory, VDB Entry
- https://www.vulncheck.com/advisories/realtyscript-stored-cross-site-scripting-via-file-upload-parameterThird Party Advisory
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5269.phpExploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.