EIP-2026-112116

This exploit demonstrates a session hijacking vulnerability in Simple Machines Forum (SMF) 2.0 by leaking the session token via the Referer header when a victim views a crafted image. The PoC then uses the stolen token to escalate privileges to admin.