CVE-2016-20053

MEDIUM

Redaxo CMS 5.2 Cross-Site Request Forgery via users endpoint

Title source: cna
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2016-20053. PoCs published by Amir.ght.

AI-analyzed exploit summary This is a functional CSRF exploit for Redaxo CMS 5.2 that adds an admin user by submitting a crafted form. The PoC includes all necessary hidden fields to create an admin account with predefined credentials.

Description

Redaxo CMS 5.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create administrative user accounts by tricking authenticated administrators into visiting malicious pages. Attackers can craft HTML forms targeting the users endpoint with hidden fields containing admin credentials and account parameters to add new administrator accounts without user consent.

Exploits (1)

exploitdb WORKING POC
by Amir.ght · htmlwebappsphp
https://www.exploit-db.com/exploits/40708

This is a functional CSRF exploit for Redaxo CMS 5.2 that adds an admin user by submitting a crafted form. The PoC includes all necessary hidden fields to create an admin account with predefined credentials.

Classification
Working Poc 95%
Attack Type
Auth Bypass
Complexity
Trivial
Reliability
Reliable
Target: Redaxo CMS 5.2
No auth needed
Prerequisites: Victim must be logged into Redaxo CMS as an admin · Attacker must trick victim into submitting the form
devstral-2 · analyzed Apr 07, 2026 Full analysis →

References (2)

Core 2
Core References
Exploit exploit
ExploitDB-40708
https://www.exploit-db.com/exploits/40708
Third Party Advisory third-party-advisory
VulnCheck Advisory: Redaxo CMS 5.2 Cross-Site Request Forgery via users endpoint
https://www.vulncheck.com/advisories/redaxo-cms-cross-site-request-forgery-via-users-endpoint

Scores

CVSS v3 5.3
EPSS 0.0001
EPSS Percentile 1.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-352
Status published
Products (2)
redaxo/redaxo 5.2
Redaxo/Redaxo CMS 5.2
Published Apr 04, 2026
Tracked Since Apr 04, 2026