RajeshTiwiva/CVE-2010-2039

GitHubRepository PoCExploit

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

JavaScript code that sends a POST request to create a new administrative user in gpEasy CMS, exploiting CVE-2010-2039 (CSRF).

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a single JavaScript file (index.js) that sends a POST request to a configurable URL to create a new administrative user. This is a straightforward proof-of-concept for the described CVE-2010-2039 CSRF vulnerability. No backdoor, concealed executable behavior, or operator-directed harm is present.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesJavaScript
Target softwaregpEasy CMS
Attack typesCross-Site Request Forgery (CSRF)
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The code actively sends a crafted request to create a new administrative user, which is the exploit action described in CVE-2010-2039. It does not merely check for the vulnerability.

index.js:27-33

Requirements

  • An administrator of the target gpEasy CMS instance must be authenticated and visit a page containing this script.index.js:1-40

Observed behavior

  • Constructs a form data payload with hardcoded username, password, email, and admin grants.index.js:1-25
  • Sends a POST request to /index.php/Admin_Users with the payload to create a new administrative user.index.js:27-33
  • Logs the server response to the console.index.js:34-40
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Credential
USERNAME='abc', PASSWORD='abc', EMAIL='abc@aa.aa'Hardcoded placeholder credentials used in the PoC request body.index.js:1-3
Url
URL='url_here'Placeholder target URL for the CSRF exploit.index.js:4
Http Request
POST to `${URL}/index.php/Admin_Users` with form-encoded bodyThe core exploit action: creating a new admin user via the vulnerable endpoint.index.js:27-33
Review boundaries

What the analysis did not establish

  • The target URL is a placeholder ('url_here') and must be replaced for the exploit to function.
  • The code does not include the CSRF token bypass or the mechanism to deliver the script to an authenticated administrator's browser; it only contains the malicious request.
  • Only one text file (index.js) was present in the repository; no other files were inspected.
  • The URL placeholder 'url_here' must be replaced by the user for the PoC to function, but this is standard PoC behavior.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1