Exploitation Summary
EIP tracks 2 public exploits for CVE-2012-4773. PoCs published by LiquidWorm.
AI-analyzed exploit summary This is a CSRF exploit for Subrion CMS 2.2.1 that adds an admin user by submitting a crafted form. It leverages lack of CSRF protection to perform unauthorized administrative actions.
Description
Multiple cross-site request forgery (CSRF) vulnerabilities in Subrion CMS before 2.2.3 allow remote attackers to hijack the authentication of administrators for requests that add, delete, or modify sensitive information, as demonstrated by adding an administrator account via an add action to admin/accounts/add/.
Exploits (2)
This is a CSRF exploit for Subrion CMS 2.2.1 that adds an admin user by submitting a crafted form. It leverages lack of CSRF protection to perform unauthorized administrative actions.
The exploit demonstrates multiple vulnerabilities in Subrion CMS 2.2.1, including SQL injection via the 'plan_id' parameter, XSS via 'f[accounts][fullname]' and 'f[accounts][username]' parameters, and CSRF to create an admin account. Functional PoC code is provided for each vulnerability.