Report at
http://lists.grok.org.uk/pipermail/full-disclosure/2010-February/073080.html

by Kristian Erik Hermansen

Cross-site request forgery explained:
http://en.wikipedia.org/wiki/Cross-site_request_forgery

and

http://www.cgisecurity.com/csrf-faq.html

Have tried to contact Kristian over details (wasn't sure how to reproduce this, might be my connection here, all I saw was a broken image...) and waiting for a reply...