---
id: 2324
title: "On-site request forgery"
source_domain: portswigger.net
source_url: "https://portswigger.net/blog/on-site-request-forgery"
published_at: "2007-05-03T08:09:00Z"
tags: ["web-security", "xss", "portswigger", "csrf", "osrf", "stored-attacks", "request-forgery"]
phying_url: "https://phying.com/item/2324"
lang: en
---

# On-site request forgery

## Summary

Stored on-site request forgery works even where XSS is blocked: controlling part of an image URL forces arbitrary on-site GET requests, e.g. creating a backdoor when an admin views the page.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2007-05-03T08:09:00Z
- **Original:** https://portswigger.net/blog/on-site-request-forgery
- **Phying News:** https://phying.com/item/2324