Sina was hacked, completely unrelated to technology, and 101% of security awareness issues.

Even a web developer at the 11th stream level knows that "do not modify data based on the content of the GET request" does not comply.

If the data of all update operations is checked to see if it is a POST request, will there be a mental attack like using URL?

 

Attackers did not even use csrf/XSS to be slightly more intelligent. A few months ago, although the content displayed on the home page was tested

XSS too much, but the XSS (Android mobile client) can be successfully displayed on the detailed page. This indicates that the content entered by the user is not

All exits are ignored.

 

I don't know if Sina has an overall Security Information Officer role. Security issues are still at the entry level.