Which of the following conditions must be given to allow a tester to exploit a Cross-Site Request Forgery (CSRF) vulnerable web application?

CSRF is not limited to Internet Explorer or any specific browser version; any browser that automatically includes cookies with cross-origin requests is susceptible.

The HttpOnly flag prevents client-side scripts from accessing cookies to defend against XSS-based cookie theft, but it does not prevent the browser from automatically attaching cookies to forged cross-site requests.

CSRF vulnerability is not tied to Firefox or any particular browser version; the attack relies on the browser's standard behavior of sending cookies with all matching requests, regardless of origin.

The primary defense against CSRF is the inclusion of a unique, secret, unpredictable anti-CSRF token in every state-changing request, which the server validates. If the application does not use such random tokens, an attacker can craft a malicious request that the victim's browser will automatically send with valid session credentials, and the server has no way to distinguish it from a legitimate request. The absence of token validation is the core architectural condition that makes CSRF exploitation possible.