Broken Access Control in Vote/Friend Function

Description Unauthorized conduct by modifying, closing/re open a poll created by someone else. Delete friend of other account via id Proof of Concept Step 1: Use account 1 to create a poll\ \ account 2 not have perrmison edit/close/open on poll \ Step 2: Intercept request when account 1 edit,...

Facebook Delete Friends Cross Site Request Forgery

Exploit Title: Facebook Delete Friends CSRF Date: 5/21/10 Author: Steven Abbagnaro Website: http://prominentsecurity.com Code: =============================================== + Facebook Delete Friends CSRF + Author: Steven Abbagnaro + Site: http://ProminentSecurity.com + Contact:...