I really, really hope there’s no JS on that page. Because if there is, given the poor design, it’s probably vulnerable to XSRF.
Gives a whole new meaning to critical vulnerabilities. Sheesh.
Gives a whole new meaning to critical vulnerabilities. Sheesh.
A site is vulnerable to XSRF if it doesn't use tokens when performing critical operations, critical operations are (usually) performed using HTTP POST, which can be done via form submission... token generation and validation is done server side...
You can perform a successful XSRF attack in a browser with javascript completely disabled.