Skip to content
On-site request forgery
portswigger.net | vulnerability | #web-security | #xss | #portswigger | #csrf | #osrf | #stored-attacks | #request-forgery
Summary
Stored on-site request forgery works even where XSS is blocked: controlling part of an image URL forces arbitrary on-site GET requests, e.g. creating a backdoor when an admin views the page.
- Published
- Collected