User deletion caused by CSRF

[eqwadasd]

CSRF exists in the background (administrator) to delete users:
The backend only cares about the values of the parameters' deleteuserids' and 'updateuserids'
So the attacker only needs to know the user's ID to construct a malicious link to complete the intrusion
The following is a normal request packet for deleting user operations。

I use this request package to construct a malicious html interface and only add the required parameters.

When a user with administrative rights clicks on this malicious link, the user (id=3) is successfully deleted.