How can a CSRF vulnerability be exploited in an insecure app

Question

I am testing a web application for security flaws and want to understand how an attacker could exploit a CSRF (Cross-Site Request Forgery) vulnerability. My key questions are:

• How does CSRF work, and what conditions must be met for an attack to succeed?
• How can an attacker craft a malicious request that executes actions on behalf of an authenticated user?
• How do real-world attacks take advantage of missing CSRF protection mechanisms?

An example of a CSRF attack in a vulnerable application and ways to prevent it would be helpful.