New answers tagged iis
2
Your vulnerability doesn't do anything in practice.
Conor already explained in his answer that Login CSRF doesn't really exist, but I think that's not the full story.
You mentioned a self-XSS vulnerability in the profile, which leads me to believe that your attack vector looks as follows:
Lure the victim to your site
Abuse a CSRF vulnerability to log the ...
3
Yep, indeed the scenario is enough to say that the web app is vulnerable to Login/Logout CSRF.
ViewState and EventValidation are not meant to protect against CSRF (I guess it's a .net/asp(x) application).
In fact
ViewState is used to track and restore the state values of controls
that would otherwise be lost, either because those values do not post
with the ...
Top 50 recent answers are included
