Looks to me like you say it's generally only possible to log people out, nothing else.

And no, i can't write anything that gives me admin rights without knowing the form-fields for everything.
But that's not the point, it's the idea itself - If I can make you write forum topics by clicking on a link, i can do other (and worse) stuff as well.

Btw: I really don't care where you throw your bones at, I didn't ask you to reply to this topic, did I?

.

Some probably wonder why the csrf logouts dont work for them.

It is because some of them use the url

http://bright-shadows.net

where others use

http://www.bright-shadows.net

(notice the www)

It seems like at least some browsers distinguish between these domains, and wont send the phpsessid's if the domain wont match.

So rhican, if you want to delete some thread, be sure to use your victims choices

.

cba either.

Proof of concept
Happy now?

.

Oh well, I see you don't get it.
Your last post is just ridiculous.

And to be honest, I don't wanna waste my time with you anymore.

cba.

ps: you are for the loose.

It's funny how you edit all your posts, so people don't see that everything you put in question had been already answered in my previous posts.
Over & out.