EIP-2026-106752

This is a functional CSRF exploit for ECK Hotel 1.0-beta that allows an unauthenticated attacker to create an admin user by tricking a victim into submitting a crafted HTML form. The exploit leverages a lack of CSRF protection in the user-add endpoint.