A critical CSRF vulnerability in Salmen2 Simple-Faucet-Script v1.07 enables unauthenticated remote code execution, posing a severe risk of full system compromise.

This is a Cross-Site Request Forgery (CSRF) vulnerability occurring at the admin.php endpoint, which lacks sufficient anti-CSRF protections and allows unauthenticated attackers to trigger unauthorized administrative actions. By tricking an authenticated administrator into submitting a crafted POST request, an attacker can achieve arbitrary code execution on the underlying server.

The vulnerability carries a CVSS score of 8.8, reflecting its high potential for total system compromise. Successful exploitation grants attackers the ability to execute arbitrary code, which can lead to complete loss of confidentiality, integrity, and availability of the host application, potentially resulting in unauthorized data exfiltration and persistent backdoors within the environment.

Immediate Action: Since no official patch is currently available, administrators should restrict access to the admin.php interface to trusted IP addresses only or disable the affected script entirely until a vendor update is released.

Proactive Monitoring: Monitor server access logs for suspicious POST requests targeting admin.php, particularly those originating from unexpected external IP addresses or lacking valid session referrers.

Compensating Controls: Deploy a Web Application Firewall (WAF) with specific rules to block suspicious POST requests directed at the admin.php?p=ads&c=1 endpoint until a formal patch is applied.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub repository referenced in the CVE record.

Given the critical impact of remote code execution, organizations using Simple-Faucet-Script v1.07 must treat this vulnerability with the highest priority. Immediate implementation of access controls is required to prevent unauthorized execution, and administrators should remain alert for vendor-issued patches to permanently remediate the underlying flaw.