Huge security issue in SoloLearn - discover now

Question

Since Sololearn has NO CSRF, we can post things on peoples accounts without them knowing.

Go to [code has been made private]
And press RUN
And it will post a code snippet on your account without you knowing

[Edit Notes by David Carroll]
Daniel Smilster Thanks for sharing this. I've removed the link and made the code private now that SoloLearn has been notified.

Answer 1

if this is true than you need to send an email to [e-mail]

Answer 2

Ace I just sent them this post to follow up with to Levon

Answer 3

Did you just rick roll us? I didn't know that was still a thing. LOL

Edit: I see, now that it does actually post things to our feed. Thanks for finding this exploit!

Answer 4

I think you should private that code or remove it completely before someone else decide to use and abuse it.

Answer 5

Jason Kennedy do you remember the profile name?

Answer 6

i seen someone doing this with rick roll already

Answer 7

Sololearn is the security issue itself. You can't fix a security issue if the whole plattform is one. Look at it. The servers of Sololearn aren't even properly configured. They throw unexpected errors all the time if you go on their website.