CSRF automatically authorizes and fixes Sina Weibo applications

With this vulnerability, third-party application developers can enable users to automatically authorize their applications without knowing the authorization button. From @ Qi Meng
Detailed description:

Sina Weibo uses the OAuth protocol for third-party applications to authorize Weibo data. When a third-party application needs to use user data, the user must log on and click the authorization button.
However, because the data in the form submitted by the authorization button is completely predictable, you can use csrf to construct a form similar to automatic submission, so that the logged-on user can authorize a third-party application without knowing it.


Proof of vulnerability:




 
 
 
Solution:

Please pay attention to adding token and other preventive measures