CVE-2015-2680
GeniXCMS < 0.0.2 - Cross-Site Request Forgery via Administrator Account Addition
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2015-2680. PoCs published by LiquidWorm.
AI-analyzed exploit summary This exploit demonstrates unauthenticated SQL injection and persistent XSS vulnerabilities in GeniXCMS v0.0.1. It includes payloads for extracting admin credentials, reading files, and executing arbitrary JavaScript via stored and reflected XSS.
Description
Cross-site request forgery (CSRF) vulnerability in MetalGenix GeniXCMS before 0.0.2 allows remote attackers to hijack the authentication of administrators for requests that add an administrator account via a request in the users page to gxadmin/index.php.
Exploits (1)
This exploit demonstrates unauthenticated SQL injection and persistent XSS vulnerabilities in GeniXCMS v0.0.1. It includes payloads for extracting admin credentials, reading files, and executing arbitrary JavaScript via stored and reflected XSS.