Next Click Ventures RealtyScript Cross-Site Scripting Vulnerability via File Upload

A stored cross-site scripting vulnerability has been identified in Next Click Ventures RealtyScript version 4.0.2. The issue arises from improper sanitization of file uploads, allowing attackers to inject malicious JavaScript into the file POST parameter of admin/tools.php. When these files are accessed by other users, the injected scripts execute in the context of the admin/tools.php page.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where uploaded files containing malicious scripts are executed when the affected page is accessed by other users.

Reproduction

To reproduce this vulnerability, upload a file through the file POST parameter in admin/tools.php. The file should contain JavaScript code, such as a script tag with an alert function. Once uploaded, the JavaScript will execute when the file is accessed by other users.