Quote from: Saulich_Fedorovich on November 10, 2018, 12:32:11 PM

But with c-cex, it's hard to find something protected on client side. For starting, everything is vulnerable to CSRF even with 2FA enabled:

Wanna change the user's chatname of someonelse? It's possible to do it by making cliking a link which trigger a POST to http://c-cex.com/?id=profile&rett=chat_b.
Wanna write a chat message with an account you don't own? It's possible to do it by making cliking a link which simply works through a GET request.
You hacked the e-mail account linked to a c-cex account? Just make the target user click a link and you'll receive the confirmation link. You also don't need to login to confirm the withdrawal (an other vulnerability combined).

In that case, the only thing protected against CSRF I found is posting limit orders. And even then it's still performed through GET requests.
I also found making someone losing all funds through clicking https://c-cex.com/?id=funds&dump=btc requires an origin matching c-cex.com. Though thats still possible to hide and trigger the target through a redirect.

There is also their internal captcha system

which is easy to solve fully automatically through things like IBM Watson or Google Cloud vision with high sucess rates.

These are indeed serious bypass that you had mentioned but it doesnt really matter at all yet this exchange do already fallen to scam anyone.Im reading once in a while
into this thread.I havent seen any response of OP on whats happening and also reading up continuous complaints about account disabled and lost funds.
Remembering C-cex glory days but they do end up like this after on that 3 months vacation alibi.