EIP-2026-105293

This is a functional CSRF PoC for ATutor 2.2.2 that demonstrates how an attacker can trick a victim into submitting a crafted POST request to create a new course without their consent. The exploit uses JavaScript to send a multipart/form-data request to the vulnerable endpoint.