Form action hijacking (stored)
Summary: PortSwigger describes form action hijacking as occurring when an application places user-supplied input into the action URL of an HTML form, letting an attacker construct a URL that redirects the form to their own server when another user visits it. In the stored variant, the input was submitted in a previous request and saved by the application, so a victim's form submission, including any data they enter, is delivered directly to the attacker, and the form may also hand over a valid CSRF token.
Bottom line: A single stored value can turn a legitimate form into a channel that delivers your users' input and a live CSRF token straight to an attacker, and browser autocomplete of previously entered data can widen what leaks.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026