CGI versions before 5.00 for Perl allow certain parameters (POSTDATA, PUTDATA, PATCHDATA, and XForms:Model) to be set from query strings or form fields, which can confuse application logic that expects these parameters to represent the actual request body. This can enable cross-site request forgery (CSRF) attacks where a malicious HTML form posts crafted data to an endpoint that reads JSON from these parameters without requiring CORS preflight.