EIP-2026-112122

This is a functional CSRF PoC for the Simple Online Hotel Reservation System, allowing an attacker to trick an authenticated admin into submitting a form that adds a new admin account. The exploit leverages a lack of CSRF tokens in the admin account creation endpoint.