CVE-2020-37217

EIP tracks 1 public exploit for CVE-2020-37217. PoCs published by indoushka.

AI-analyzed exploit summary This is a functional CSRF PoC for Easy2Pilot 7 that crafts an HTML form to add a new user via a POST request to the admin panel. The exploit leverages a lack of CSRF token validation in the application.

Easy2Pilot 7 contains a cross-site request forgery vulnerability that allows attackers to add unauthorized user accounts by tricking authenticated administrators into visiting malicious pages. Attackers can craft HTML forms targeting the admin.php?action=add_user endpoint with POST requests containing username and password parameters to create new administrative accounts without explicit user consent.