Account dashboard
The "Close account" control here is a link, not a form. Trigger it from an attacker page without the victim clicking anything.
Signed in as
victim
Account status
Active
How the app renders its own "Close account" control:
<a href="index.php?action=close">Close account</a>
Attacker page — paste the HTML you would host. It is loaded in the victim's logged-in browser.
Stuck? You've missed the flag a few times. The full solution — root cause, exact payload and fix — is on the walkthrough page.
Check the solution on the walkthrough page →This is an isolated, intentionally-vulnerable sandbox. Data here is fake and scoped to you. The rest of CSPSHIVAM Playground is not part of the target.