BAC + CSRF

It was a Self-Hosted program with limited scope, so I started exploring the main application