XSRF and threat ratings
Summary: PortSwigger Research argues that cross-site request forgery forces a reassessment of threat ratings for other vulnerabilities, using an admin-only ViewUser.asp SQL injection as its example. Because an attacker can craft a malicious page that makes a logged-in administrator's browser submit a stacked query like inserting a new admin user, the SQL injection should be rated at least as seriously as an XSRF-exposed doSQL.php function that runs arbitrary queries by design.
Why it matters: Access controls that keep a SQL injection reachable only by trusted administrators stop mattering once a forged request can ride an admin's logged-in session, so a bug previously filed as low-risk defence-in-depth can carry the same impact as a deliberately open query function.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026