RajeshTiwiva

GitHub · Repository owner · Source ID 283901279
Source profile

Source-scoped identity with 1 associated PoC and 1 linked vulnerability.

Showing 1 PoC on this page

GitHub

RajeshTiwiva/CVE-2010-2039

Repository PoC0Created 2026-05-12ExploitCVE-2010-20391 file

785 B

GitHubPoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

JavaScript code that sends a POST request to create a new administrative user in gpEasy CMS, exploiting CVE-2010-2039 (CSRF).

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a single JavaScript file (index.js) that sends a POST request to a configurable URL to create a new administrative user. This is a straightforward proof-of-concept for the described CVE-2010-2039 CSRF vulnerability. No backdoor, concealed executable behavior, or operator-directed harm is present.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesJavaScript
Target softwaregpEasy CMS
Attack typesCross-Site Request Forgery (CSRF)
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The code actively sends a crafted request to create a new administrative user, which is the exploit action described in CVE-2010-2039. It does not merely check for the vulnerability.

index.js:27-33

Requirements

  • An administrator of the target gpEasy CMS instance must be authenticated and visit a page containing this script.index.js:1-40

Observed behavior

  • Constructs a form data payload with hardcoded username, password, email, and admin grants.index.js:1-25
  • Sends a POST request to /index.php/Admin_Users with the payload to create a new administrative user.index.js:27-33
  • Logs the server response to the console.index.js:34-40
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Credential
Payload withheldHardcoded placeholder credentials used in the PoC request body.index.js:1-3
Url
Payload withheldPlaceholder target URL for the CSRF exploit.index.js:4
Http Request
Payload withheldThe core exploit action: creating a new admin user via the vulnerable endpoint.index.js:27-33
Review boundaries

What the analysis did not establish

  • The target URL is a placeholder ('url_here') and must be replaced for the exploit to function.
  • The code does not include the CSRF token bypass or the mechanism to deliver the script to an authenticated administrator's browser; it only contains the malicious request.
  • Only one text file (index.js) was present in the repository; no other files were inspected.
  • The URL placeholder 'url_here' must be replaced by the user for the PoC to function, but this is standard PoC behavior.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.