CVE-2010-2039

gpEasy 1.6.1 - Cross-Site Request Forgery (Add Admin)

Title source: exploit-db.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2010-2039 has a selected CVSS score of 6.8; EIP currently links 1 catalogued exploit and 1 repository PoC.

Description

Cross-site request forgery (CSRF) vulnerability in gpEasy CMS 1.6.2, 1.6.1, and earlier allows remote attackers to hijack the authentication of administrators for requests that create new administrative users via an Admin_Users action to index.php. NOTE: some of these details are obtained from third party information.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1
Repository PoCs
1

Proofs of concept

2

Catalogued exploits

ExploitDBgpEasy 1.6.1 - Cross-Site Request Forgery (Add Admin)ExploitDB exploitby Giuseppe 'giudinvx' D'InvernoNot analyzed1 file
ExploitDB
PoC details

Repository PoCs

GitHubRajeshTiwiva/CVE-2010-2039Repository PoCby RajeshTiwiva0Exploit1 file

785 B

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

JavaScript code that sends a POST request to create a new administrative user in gpEasy CMS, exploiting CVE-2010-2039 (CSRF).

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a single JavaScript file (index.js) that sends a POST request to a configurable URL to create a new administrative user. This is a straightforward proof-of-concept for the described CVE-2010-2039 CSRF vulnerability. No backdoor, concealed executable behavior, or operator-directed harm is present.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesJavaScript
Target softwaregpEasy CMS
Attack typesCross-Site Request Forgery (CSRF)
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The code actively sends a crafted request to create a new administrative user, which is the exploit action described in CVE-2010-2039. It does not merely check for the vulnerability.

index.js:27-33

Requirements

  • An administrator of the target gpEasy CMS instance must be authenticated and visit a page containing this script.index.js:1-40

Observed behavior

  • Constructs a form data payload with hardcoded username, password, email, and admin grants.index.js:1-25
  • Sends a POST request to /index.php/Admin_Users with the payload to create a new administrative user.index.js:27-33
  • Logs the server response to the console.index.js:34-40
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Credential
Payload withheldHardcoded placeholder credentials used in the PoC request body.index.js:1-3
Url
Payload withheldPlaceholder target URL for the CSRF exploit.index.js:4
Http Request
Payload withheldThe core exploit action: creating a new admin user via the vulnerable endpoint.index.js:27-33
Review boundaries

What the analysis did not establish

  • The target URL is a placeholder ('url_here') and must be replaced for the exploit to function.
  • The code does not include the CSRF token bypass or the mechanism to deliver the script to an authenticated administrator's browser; it only contains the malicious request.
  • Only one text file (index.js) was present in the repository; no other files were inspected.
  • The URL placeholder 'url_here' must be replaced by the user for the PoC to function, but this is standard PoC behavior.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

7