I said, it's a way to replace a website form with another form in order to exploit a vulnerability. Can be avoided by using 'protect from forgery' in the application controller