A stored cross-site scripting vulnerability in Next Click Ventures RealtyScript 4.0.2 allows authenticated attackers to execute arbitrary code within the context of an administrator browser session.

This is a stored cross-site scripting (XSS) vulnerability occurring in the location_name parameter of the admin locations interface. An authenticated attacker can submit malicious JavaScript payloads via a POST request to the locations.php endpoint, which will then execute when an administrator views the affected interface.

The exploitation of this vulnerability allows an attacker to execute arbitrary scripts within the administrative session of the software. This can lead to the theft of administrative session cookies, unauthorized modification of site content, or the creation of rogue administrative accounts. Given the CVSS score of 7.2, this represents a significant risk to the integrity and confidentiality of the web application management console.

Immediate Action: As no official patch is documented for this legacy version, users are advised to restrict access to the administrative interface to trusted networks only and consider migrating to a more secure, actively supported real estate management solution.

Proactive Monitoring: Security teams should monitor web access logs for unusual POST requests directed at the locations.php and editadmins.php endpoints, particularly those containing script tags or suspicious encoded characters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict input validation rules configured to block common XSS payloads, such as script tags and event handlers, from being submitted to administrative endpoints.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the Exploit Database (EDB-38496).

This vulnerability presents a high risk due to the potential for full administrative account compromise via XSS. Organizations still utilizing RealtyScript 4.0.2 must prioritize the implementation of strict network access controls and WAF filtering to prevent unauthorized input. Given the age and lack of vendor support, migration to a modern, patched platform is strongly recommended to eliminate this exposure permanently.