CSRF on https://apps.topcoder.com/wiki/users/editmyprofile.action
Medium
L
Lab45
Submitted None
Actions:
Reported by
meryem0x
Vulnerability Details
Technical details and impact analysis
## Summary:
Hi :) There is a CSRF on changing user details.
## Steps To Reproduce:
There is no CSRF token or anything like that on https://apps.topcoder.com/wiki/users/editmyprofile.action . I added the poc html file below. When someone opens this html file, or we can add it into our website, victim's name and information will change.
Note: This only works to signed-in users. Because unauthorized users cannot upload attachments. There is a mistake on https://apps.topcoder.com/wiki/login.action now. If you encounter an error, you can login on main site (https://accounts.topcoder.com/member) then try.
## Impact
An attacker can force other users to change their name and informations without their knowledge.
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Submitted
Weakness
Cross-Site Request Forgery (CSRF)