EIP-2026-105020

This exploit demonstrates a CSRF vulnerability in AfterLogic WebMail Lite PHP <= 7.0.1, allowing an attacker to reset the admin password by tricking an authenticated admin into visiting a malicious page. The PoC includes an auto-submitting HTML form that changes the admin credentials to '0wned1'.