News for hackers. Stuff that matters.

A comment on PayPal.com XSS Vulnerability. Parent comment

Re:PayPal.com XSS Vulnerability by psychometry on Sunday May 26, 2013 @02:45PM (#5772011)
I'm sure PayPal is using some form or CSRF protection to prevent a POST from some external site from working.
[ Parent | on HN ]
Re:PayPal.com XSS Vulnerability by mattbasta on Sunday May 26, 2013 @02:49PM (#5772027)
There's a CSRF token in the form, but deleting it doesn't seem to cause the search to fail.
[ Parent | on HN ]
Re:PayPal.com XSS Vulnerability by tekacs on Sunday May 26, 2013 @03:58PM (#5772223)
It's a search form.

It seems quite possible that CSRF checks could have been omitted in not expecting this to be a source of woe. Just goes to show... :P

[ Parent | on HN ]