EIP-2026-112464

This is a functional CSRF PoC for Subrion CMS 4.0.5 that crafts a multipart/form-data request to add an admin user via an authenticated endpoint. The exploit uses JavaScript to send a POST request with all required form fields, including a CSRF token.