Sohu mailbox csrf can forward user emails and modify user information.

Sohu mailbox basically does not provide csrf defense. As long as an html email is sent to the user, if the user clicks the link in it, it will be a great deal .. There are multiple problems, so I can take one example. In the proof, I forwarded all emails of the user to the email address specified by the supervisor. Is this too large? Send an html email to the attacker. Because sohu only recognizes post requests, an external site link is constructed, THE post request initiated by the external site clicks the link in the email to see the content of the external site bingo! Result

Solution:Csrf is routinely processed. You will. If the changes are large, check the referer at least.