Sina Weibo's two CSRF followers

The interfaces for Weibo and followers should be well managed, Sina! No referer verification, no token added, resulting in logon to Sina Weibo social recruitment: http://hr.weibo.com/jobs/index.phpwhen the following pocpage Solution:

1. This site is not protected by CSRF. Please perform other checks; 2. Check the POST Referer and add the token in the POST information;



After paying more attention to it, I added a hole in detail: No referer verification, no token added, resulting in proof of vulnerability: log on to Sina Weibo social recruitment: http://campus.sina.com.cn visit the following poc page Solution:

1. This site is also not protected by CSRF. Please perform other checks; 2. Check the POST Referer and add the token in the POST information;