EIP-2026-109271

This exploit demonstrates a CSRF vulnerability in Mambo CMS 4.6.5, allowing an attacker to trick an authenticated admin into submitting a malicious form that modifies user privileges. The PoC uses JavaScript to auto-submit a form that changes a user's group ID to an admin-level role.