---
id: 521
title: "XSRF and threat ratings"
source_domain: portswigger.net
source_url: "https://portswigger.net/blog/xsrf-and-threat-ratings"
published_at: "2008-03-20T19:16:00Z"
tags: ["sql-injection", "web-security", "penetration-testing", "csrf", "xsrf", "threat-rating"]
phying_url: "https://phying.com/item/521"
lang: en
---

# XSRF and threat ratings

## Summary

XSRF changes how we rate other vulnerabilities: SQL injection restricted to admins can be exploited via XSRF just like an intended admin query feature, so both deserve equally serious ratings.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2008-03-20T19:16:00Z
- **Original:** https://portswigger.net/blog/xsrf-and-threat-ratings
- **Phying News:** https://phying.com/item/521