Lab 153 — FlowDesk — CSRF Account Takeover via Email Change

hackadvisor

Task: Express.js workspace platform where email change endpoint lacks CSRF protection while name/password endpoints are protected. Solution: exploited password reset token disclosure to take over admin account, or alternatively use CSRF via admin bot to change admin's email, then reset password and access admin panel for flag.