CVE-2010-2039
gpEasy CMS <= 1.6.2 - Cross-Site Request Forgery via Admin_Users Action
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2010-2039. PoCs published by Giuseppe 'giudinvx' D'Inverno, RajeshTiwiva.
AI-analyzed exploit summary This exploit demonstrates a CSRF vulnerability in gpEasy <= 1.6.1, allowing an attacker to create an admin user by tricking an authenticated admin into submitting a malicious form.
Description
Cross-site request forgery (CSRF) vulnerability in gpEasy CMS 1.6.2, 1.6.1, and earlier allows remote attackers to hijack the authentication of administrators for requests that create new administrative users via an Admin_Users action to index.php. NOTE: some of these details are obtained from third party information.
Exploits (2)
This exploit demonstrates a CSRF vulnerability in gpEasy <= 1.6.1, allowing an attacker to create an admin user by tricking an authenticated admin into submitting a malicious form.
This PoC exploits an authentication bypass vulnerability in the target software by sending a crafted POST request to create a new admin user without proper authorization. The exploit leverages a flawed user creation mechanism in the Admin_Users endpoint.