CVE-2010-5084

CVE-2010-5084 describes a Cross-Site Request Forgery (CSRF) vulnerability in e107 versions prior to 0.7.23. The flaw stems from a predictable random token used in the CSRF protection mechanism, which is based on the administrator account's creation date. This allows authenticated remote attackers to hijack administrator sessions to add new users through e107_admin/users.php. The vulnerability has a CVSS score of 6.0, indicating a medium severity. It requires authentication (Au:S) and medium attack complexity (AC:M), but can lead to partial confidentiality, integrity, and availability impacts (C:P/I:P/A:P). There is no evidence of active exploitation, nor are there known Metasploit, Nuclei, or ExploitDB modules available. Community discussion and media coverage for this CVE are minimal, suggesting low public awareness and a lack of widespread exploitation.