cspshivam/playground
CSRF Level 1 / 6 Easy
← All labs

Unguarded Email Change

A signed-in account can swap its email with no anti-forgery token. Drive that change from a request the user never intended.

Reset lab

Account settings

You are viewing the victim's logged-in account. The "Update email" form below posts to this same endpoint. Your job: get that email changed without the victim ever submitting the form.

Signed in as

victim

Current email on file

victim@cspshivam.com

The application's real "Update email" form (for reference — this is what the app serves):

<form method="POST" action="index.php"> <input name="email" value="victim@cspshivam.com"> <button>Update email</button> </form>

Attacker page — paste the HTML you would host on your own site. When you deliver it, the victim's browser (already logged in here) opens it.

This is an isolated, intentionally-vulnerable sandbox. Data here is fake and scoped to you. The rest of CSPSHIVAM Playground is not part of the target.