Which of the following conditions must be given to allow a tester to exploit a Cross-Site Request Forgery (CSRF) vulnerable web application?

CSRF exploitation is not limited to Internet Explorer prior to version 8 - all browsers will automatically attach session cookies to cross-origin requests unless same-site cookie policies are enforced.

The HttpOnly flag prevents client-side JavaScript from reading cookies, but CSRF does not require reading the cookie - the browser automatically sends it with the forged request regardless of the HttpOnly flag.

CSRF is not dependent on Firefox version - the attack relies on browser cookie-handling behavior that is consistent across modern browsers and versions.

The fundamental defense against CSRF is the use of a random, unpredictable synchronizer token tied to the user's session. Without this token, the server cannot distinguish a legitimate user-initiated request from a forged one crafted by an attacker. When the application omits random tokens, any cross-origin request carrying the victim's session cookie will be accepted.