A CSRF vulnerability on ChildsMath’s profile update endpoint that enabled stored XSS via unsanitized name fields. The injected script persisted across every page in the application, and the same request could change the recovery email to execute a full account takeover.
How Chrome’s ‘Lax + 2 minute’ cookie intervention opened a CSRF window on ChildsMath, a math learning platform used by McMaster University students, letting an attacker silently redirect a student’s grades to an attacker-controlled email.
A critical CSRF vulnerability in a popular reading platform’s email change endpoint that required nothing more than a single click to fully hijack an account.