The djangoSIGE application through version 1.10 (commit a6fe7e8) is vulnerable to CSRF attacks due to order cancellation logic implemented inside HTTP GET method handlers in views such as CancelarOrcamentoVendaView, CancelarPedidoVendaView, CancelarOrcamentoCompraView, and CancelarPedidoCompraView. Since Django's CsrfViewMiddleware enforces CSRF token validation only on unsafe HTTP methods (e.g., POST, PUT, DELETE), these GET requests can be exploited by attackers who lure authenticated users with the necessary permissions to a malicious page containing cross-origin references to the cancellation endpoints. This allows unauthorized cancellation of sales or purchase orders without the victim's explicit consent.

An attacker can cause an authenticated user with change_orcamentovenda or equivalent permissions to unknowingly cancel sales or purchase orders. This can disrupt business operations by invalidating legitimate orders. The vulnerability does not require the attacker to be authenticated and bypasses CSRF protections due to misuse of HTTP GET for state-changing operations.

No official patch or remediation is currently documented for this vulnerability. Users should avoid using vulnerable versions (<=1.10) or modify the application to ensure that state-changing operations like order cancellations are not handled via HTTP GET requests. Instead, these should be implemented using HTTP methods that enforce CSRF protection, such as POST, along with proper CSRF token validation. Monitor vendor advisories for any forthcoming official fixes.