# Exploit Title: SuperMicro IPMI WebInterface 03.40 - Cross-Site Request Forgery (Add Admin)
# Exploit Author: Metin Yunus Kandemir
# Date: 2020-07-15
# Vendor Homepage: https://www.supermicro.com/
# Version: X10DRH-iT motherboards with BIOS 2.0a and IPMI firmware 03.40
# CVE: CVE-2020-15046
# Source: https://www.totalpentest.com/post/supermicro-ipmi-webgui-cross-site-request-forgery
# Description:
# The web interface on Supermicro X10DRH-iT motherboards with BIOS 2.0a and IPMI firmware 03.40
# allows remote attackers to exploit a cgi/config_user.cgi CSRF issue to add new admin users.
# The fixed versions are BIOS 3.2 and firmware 03.88.
# PoC :