A library account settings page changes email via session-cookie authenticated POST with no anti-CSRF token or equivalent defense. What vulnerability class fits?
Select an answer to reveal the explanation.
Short Explanation
If the clerk trusts every letter that arrives with your cookie crumbs, a forged form can change your address. CSRF rides authenticated sessions into state-changing POSTs. Tokens or equivalent checks break that trick.
Full Explanation
Cross-site request forgery targets state-changing requests that rely on ambient authentication such as cookies without a secret the attacker cannot read. Missing CSRF tokens, weak SameSite policies, or GET-based state changes increase risk. Defenses include anti-CSRF tokens, SameSite cookies, and re-authentication for sensitive changes. SQLi or SPF findings do not explain this email-change pattern.