Professional 1.5.06
Summary: PortSwigger released Burp Suite Professional 1.5.06 on 26 February 2013, adding a CSRF PoC generator technique that builds cross-domain requests using XmlHttpRequest to submit arbitrary binary request bodies with standard Content-Type headers, including form-urlencoded and multipart/form-data. The technique relies on CORS and the fact that requests with only "simple" features are not preflighted, so the browser sends the full cross-domain request with an Origin header that servers typically ignore.
Key Takeaway: The release notes state that servers will typically ignore the Origin header and process the request normally, which is what lets a cross-domain file upload carry a filename attribute that a pure HTML form cannot produce without inducing the victim to select a file.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026