CVE-2006-4584
Tr Forum 2.0 - Unauthenticated Authentication Bypass and Admin Account Creation via Admin Insert Endpoint
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2006-4584. PoCs published by EL-KAHINA, DarkFig.
AI-analyzed exploit summary This exploit demonstrates a CSRF vulnerability in TR Forum 1.5, allowing an attacker to trick an authenticated admin into submitting a form that adds a new admin account. The PoC is a simple HTML form that submits to the vulnerable endpoint.
Description
Tr Forum 2.0 allows remote attackers to bypass authentication and add an administrative account via the login and password parameters to admin/insert_admin.php.
Exploits (2)
This exploit demonstrates a CSRF vulnerability in TR Forum 1.5, allowing an attacker to trick an authenticated admin into submitting a form that adds a new admin account. The PoC is a simple HTML form that submits to the vulnerable endpoint.
This exploit demonstrates SQL injection and authentication bypass in Tr Forum V2.0 by creating a new admin user and extracting admin credentials via a UNION-based SQLi attack.