CVE-2012-1058

Flyspray 0.9.9.6 - Cross-Site Request Forgery via Admin User Creation

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2012-1058. PoCs published by Vaibhav Gupta.

AI-analyzed exploit summary This is a CSRF exploit for Flyspray 0.9.9.6 that adds an admin account when a victim visits the malicious HTML page. It submits a form with predefined admin credentials to the target application.

Description

Cross-site request forgery (CSRF) vulnerability in Flyspray 0.9.9.6 allows remote attackers to hijack the authentication of admins for requests that add admin accounts via an admin.newuser action to index.php.

Exploits (1)

exploitdb WORKING POC
by Vaibhav Gupta · htmlwebappsphp
https://www.exploit-db.com/exploits/18468

This is a CSRF exploit for Flyspray 0.9.9.6 that adds an admin account when a victim visits the malicious HTML page. It submits a form with predefined admin credentials to the target application.

Classification
Working Poc 100%
Attack Type
Auth Bypass
Complexity
Trivial
Reliability
Reliable
Target: Flyspray 0.9.9.6
No auth needed
Prerequisites: Victim must be authenticated in the target Flyspray instance · Victim must visit the malicious HTML page
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (5)

Core 5
Core References
Exploit exploit x_refsource_exploit-db
http://www.exploit-db.com/exploits/18468
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/73051
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/47881
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://osvdb.org/78923

Scores

EPSS 0.0094
EPSS Percentile 56.0%

Details

CWE
CWE-352
Status published
Products (1)
flyspray/flyspray 0.9.9.6
Published Feb 14, 2012
Tracked Since Feb 18, 2026