Writeups
Multiple CSRF + IDOR — Car Marketplace Platform
Two CSRF vulnerabilities on a car marketplace — one allowed modifying other users' listings (CSRF + IDOR), the other silently added cars to a victim's saved list.
Csrf
2 articlesWriteups
CSRF — Missing Protection on Editor API Endpoint
A state-changing API endpoint in a web application editor had no CSRF protection at all, allowing attackers to silently inject data into victim accounts via a simple HTML form.