Next Click Ventures RealtyScript Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in Next Click Ventures RealtyScript version 4.0.2. The issue resides in the location_name parameter within the admin locations interface. Attackers can exploit this vulnerability by sending POST requests to the locations.php endpoint, injecting JavaScript payloads into the location_name field. This allows for the execution of arbitrary code in the browsers of administrators.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the affected page.

Reproduction

To reproduce this vulnerability, log into the admin interface of RealtyScript 4.0.2. Navigate to the locations management page and submit a new location with a name that includes a JavaScript payload, such as a script tag. Once the location is saved, the injected script will execute when the location is viewed.