CVE-2016-10738

HIGH

Zenbership v107 - Cross-Site Request Forgery via Event Add Function

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2016-10738. PoCs published by Besim.

AI-analyzed exploit summary The exploit demonstrates two vulnerabilities in Zenbership: a stored XSS via the 'last_name' parameter in a contact form and a CSRF vulnerability allowing event creation with malicious payloads. Both include detailed HTTP requests and a functional CSRF PoC HTML form.

Description

Zenbership v107 has CSRF via admin/cp-functions/event-add.php.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Besim · textwebappsphp

https://www.exploit-db.com/exploits/40620

View Code ZIP pw:eip

The exploit demonstrates two vulnerabilities in Zenbership: a stored XSS via the 'last_name' parameter in a contact form and a CSRF vulnerability allowing event creation with malicious payloads. Both include detailed HTTP requests and a functional CSRF PoC HTML form.

Classification

Working Poc 95%

Attack Type

Xss

Complexity

Moderate

Reliability

Reliable

Target: Zenbership (latest version as of 2016)

Auth required

Prerequisites: Admin access to the Zenbership panel · Victim interaction for XSS payload execution

MITRE ATT&CK

T1189 - Drive-by Compromise T1059 - Command and Scripting Interpreter

devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (1)

Core 1

Core References

Third Party Advisory, VDB Entry exploit x_refsource_exploit-db

https://www.exploit-db.com/exploits/40620

Scores

CVSS v3 8.8

EPSS 0.0068

EPSS Percentile 47.4%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE

CWE-352

Status published

Products (1)

castlamp/zenbership 107

Published Jan 16, 2019

Tracked Since Feb 18, 2026