On-site request forgery
Summary: PortSwigger Research describes on-site request forgery as an attack payload long used with stored XSS, citing the MySpace worm in which Samy placed a script in his profile that made viewers add him as a friend and copy the script into their own profiles. The article shows the attack also works without XSS: in a message board that HTML-encodes "<", ">" and quote characters, an attacker who controls part of an <img> tag's target URL can make anyone viewing the message issue an arbitrary on-site GET request, such as one that creates an administrative user.
Key Takeaway: The forged request fails for an ordinary user but succeeds when an administrator views the message, creating a backdoor account - and it still works if administrators disable JavaScript.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026