A change with nothing guarding it

The account's email

The account page at /app/profile shows the current email, and a POST to the same URL changes it:

curl -s http://127.0.0.1:8080/app/profile
curl -s -d 'email=new@vulntech.local' http://127.0.0.1:8080/app/profile
curl -s http://127.0.0.1:8080/app/profile

In the terminal

student@vulntech:~$ curl -s http://127.0.0.1:8080/app/profile
Current account email: user@vulntech.local
student@vulntech:~$ curl -s -d 'email=new@vulntech.local' http://127.0.0.1:8080/app/profile
Account email updated to: new@vulntech.local
student@vulntech:~$ curl -s http://127.0.0.1:8080/app/profile
Current account email: new@vulntech.local

The change went through on a plain POST. In a real app the victim's session cookie would ride along automatically — and that's the whole problem: the server accepts the request on the strength of the cookie alone, with nothing to prove the victim meant to send it.