CVE-2012-1416
SocialCMS 1.0.2 - Cross-Site Request Forgery in Administrator Account Management
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2012-1416. PoCs published by Ivano Binetti, vir0e5.
AI-analyzed exploit summary This exploit demonstrates a CSRF vulnerability in SocialCMS 1.0.2, allowing an attacker to add an admin account by tricking a logged-in admin into visiting a malicious page. The form submits automatically via JavaScript to create a new admin user.
Description
Multiple cross-site request forgery (CSRF) vulnerabilities in SocialCMS 1.0.2 allow remote attackers to hijack the authentication of administrators for requests that (1) add administrator accounts via a member_new action to my_admin/admin1_members.php or (2) modify the default site title via a save action to my_admin/admin1_configuration.php.
Exploits (2)
This exploit demonstrates a CSRF vulnerability in SocialCMS 1.0.2, allowing an attacker to add an admin account by tricking a logged-in admin into visiting a malicious page. The form submits automatically via JavaScript to create a new admin user.
This exploit demonstrates CSRF vulnerabilities in SocialCMS 1.0.2, allowing an attacker to create an admin user and modify site configuration without user interaction. The PoC uses auto-submitting forms to trigger the actions.