Csrf of xiaguo network can hijack user accounts

1. csrf exists in the account to be hijacked. You can modify the email address to hijack the account. Because one mailbox can only be bound to one account, you can use arrays to randomly select mailboxes. POC:
1. Account hijacking



Http://email.smtp.yupage.com/xianguo2.htm2.modify information http://email.smtp.yupage.com/xianguo.htm

 Solution:

Random token