Well I posted this on some other forum but noone seemed interested or wanted to talk about it so here I am and I would really get some feedback about it! I found a (my first) csrf in tracker.com/takeprofedit.php?email=.... I haven't seen any tracker needing the password or a sid to change the email in the profile. So you can very simple abuse this with a csrf to change the email and then
Forum: CSRF and Session Info