CVE-2010-3891
IBM OmniFind Enterprise Edition < 9.1 - Cross-Site Request Forgery in Administrator Interface
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2010-3891. PoCs published by Fatih Kilic.
AI-analyzed exploit summary This is a functional CSRF exploit for CVE-2010-3891, demonstrating how an attacker can add an admin user to IBM OmniFind Enterprise Edition via a malicious form submission. The exploit leverages the lack of CSRF protection in the administrator interface.
Description
Cross-site request forgery (CSRF) vulnerability in ESAdmin/security.do in the administrator interface in IBM OmniFind Enterprise Edition before 9.1 allows remote attackers to hijack the authentication of administrators for requests that add an administrative user via a saveNewUser action.
Exploits (1)
This is a functional CSRF exploit for CVE-2010-3891, demonstrating how an attacker can add an admin user to IBM OmniFind Enterprise Edition via a malicious form submission. The exploit leverages the lack of CSRF protection in the administrator interface.