Lab: Performing CSRF exploits over GraphQL
Summary: PortSwigger's lab shows a GraphQL user-management endpoint that accepts x-www-form-urlencoded requests, making it vulnerable to cross-site request forgery. The walkthrough converts an email-change mutation into a form-encoded POST, generates a CSRF proof of concept in Burp, and delivers the HTML from the exploit server to change the victim's email address.
Why it matters: A GraphQL mutation that accepts form-encoded content can be triggered from a victim's browser with their session cookie, so an attacker who lands one page can change account details like email without ever seeing the response.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026