EIP-2026-107940

This is a functional CSRF exploit for Invoice Manager v3.1 that adds a new admin user via a crafted HTML form. The exploit leverages the lack of CSRF tokens in the application, allowing an attacker to trick an authenticated admin into submitting the form.