Question about the nature of CSRF

Question

XSS

Do I understand correctly that if no data is changed on the site by get or post and there is no vulnerability to XSS, then there is no vulnerability to CSRF, since cross-site Ajax requests are prohibited by the browser's security policy? Of course, provided that the user does not use an exotic browser or has not disabled security settings.

Answer 1

CSRF is not required but an AJAX request. It can be just a form on any domain submitting data to your script. But if, as you say, no data changes, then you should not worry. In that case, why is the site not static? The admin area can also be vulnerable to CSRF.