Account settings — token protected
This "Update email" form ships a per-user anti-CSRF token, so a blank forgery is rejected. The token is not shown to you (an attacker can't read the victim's page). Defeat it anyway.
Signed in as
victim
Current email on file
victim@cspshivam.com
The app's real form (the token value is server-side, shown here masked):
<form method="POST" action="index.php">
<input type="hidden" name="token" value="********************************">
<input name="email">
</form>
Attacker page — paste the HTML you would host. It runs in the victim's logged-in browser.
Stuck? You've missed the flag a few times. The full solution — root cause, exact payload and fix — is on the walkthrough page.
Check the solution on the walkthrough page →This is an isolated, intentionally-vulnerable sandbox. Data here is fake and scoped to you. The rest of CSPSHIVAM Playground is not part of the target.