A quick fix against CSRF is to check the
Origin HTTP header. At least one of these should be set and the domain it contains should be your domain (i.e. same origin).
Note that this will break cases where your site is accessed from a bookmark, link inside a mail or similar since in thus cases no
Referer will be sent. But in no case you should simply accept an empty
Referer (unless you have a non-empty
Origin header) since this is easy to create for an attacker.
You should also make sure that your checks for the domain are correct. This is, if your site is
www.example.com you must not accept
You should also make sure that the attacker can not use other functionality (or bugs) in your application as a trampoline to create a custom request with malicious payload but the expected same-origin
Referer. As Arminius nicely pointed out in a comment, open redirects might be such a trampoline. Thus you should either make sure that all requests to the domain have a same-origin
Referer or that any parts which might need to accept a cross-origin
Referer can not be abused as trampoline.
For more information about this method of protecting against CSRF and about its potential problems see Verifying Same Origin with Standard Headers in the Cross-Site Request Forgery (CSRF) Prevention Cheat Sheet from OWASP.