Threats tagged 'ghsa-4758-h5xr-5h97'

A Cross-Site Request Forgery (CSRF) vulnerability exists in the OrderConfirmController at the GET /order/confirm/{order_number} endpoint in Roskus Prospero Flow CRM versions before 5.15.11. This flaw allows an unauthenticated attacker to confirm orders on behalf of authenticated users by tricking them into visiting a crafted link. The vulnerability arises because Laravel's CSRF protection middleware does not enforce tokens on GET requests, and the order confirmation action is exposed via a GET route. Since session cookies with SameSite=Lax are sent automatically on top-level cross-site navigations, a single click can confirm an order without user consent. Additionally, sequential order numbers enable attackers to enumerate and confirm multiple orders automatically.