Exploitation Summary
EIP tracks 1 public exploit for CVE-2008-7248. PoCs published by p0deje.
AI-analyzed exploit summary This exploit demonstrates a CSRF vulnerability in Redmine <= 0.8.6, allowing an attacker to create an admin user via a crafted HTML form. The PoC automatically submits the form using JavaScript, bypassing user interaction.
Description
Ruby on Rails 2.1 before 2.1.3 and 2.2.x before 2.2.2 does not verify tokens for requests with certain content types, which allows remote attackers to bypass cross-site request forgery (CSRF) protection for requests to applications that rely on this protection, as demonstrated using text/plain.
Exploits (1)
This exploit demonstrates a CSRF vulnerability in Redmine <= 0.8.6, allowing an attacker to create an admin user via a crafted HTML form. The PoC automatically submits the form using JavaScript, bypassing user interaction.