CVE-2015-5075

X2Engine X2CRM < 5.0.9 - Cross-Site Request Forgery via User Creation

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2015-5075. PoCs published by Portcullis.

AI-analyzed exploit summary This is a CSRF exploit for CVE-2015-5075, which allows an attacker to force the creation of a new administrative account in X2Engine. The exploit is delivered via an HTML form that submits a POST request to the vulnerable endpoint.

Description

Cross-site request forgery (CSRF) vulnerability in X2Engine X2CRM before 5.2 allows remote attackers to hijack the authentication of administrators for requests that create an administrative account via a crafted request to index.php/users/create.

Exploits (1)

exploitdb WORKING POC
by Portcullis · textwebappsphp
https://www.exploit-db.com/exploits/38321

This is a CSRF exploit for CVE-2015-5075, which allows an attacker to force the creation of a new administrative account in X2Engine. The exploit is delivered via an HTML form that submits a POST request to the vulnerable endpoint.

Classification
Working Poc 100%
Attack Type
Auth Bypass
Complexity
Trivial
Reliability
Reliable
Target: X2Engine (version not specified)
No auth needed
Prerequisites: Victim must be logged in as an administrator · Victim must visit the malicious HTML page
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (5)

Core 5
Core References
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/536547/100/0/threaded
Mailing List mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2015/Sep/93
Exploit, Third Party Advisory exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/38321/

Scores

EPSS 0.0276
EPSS Percentile 84.3%

Details

CWE
CWE-352
Status published
Products (1)
x2engine/x2crm < 5.0.9
Published Sep 29, 2015
Tracked Since Feb 18, 2026