Letv xss can obtain identity information, CSRF can also use others' accounts

A csrf alternative application
1. first, log on to letv and go to the personal settings page: 2. you can see that the relevant QQ mailbox has been bound. Click to change my mailbox: 3. after setting the mailbox to change, click to send, This is the packet capture will request interception, the original is a GET request http://my.letv.com/my_setting.php? Action = outemail & bingEmail = ********* @ qq.com proof of vulnerability: 4. send this link to the specified letv user. Once the recipient clicks the link, my mailbox will receive the bound email, of course, the more concealed method of use is to insert the above GET request in the left-side address of letv as long as someone sees it:



5. Click the above address to change the email address! 6. Then, retrieve the password and obtain others' account information!
Solution:

1. CSRF is not fortified! Check the entire site! 2. The difference between this issue and other websites is that for other websites, you must unbind the bound email address first! You can send an unbind link to the original mailbox or unbind it from the bound mobile phone, but there is nothing here; 3. the key interface does not perform user verification. For example, you are prompted to enter the password before binding an email or mobile phone. Even setting an image verification code can prevent this situation.