Djangosige
Monthly
Cross-site request forgery in djangoSIGE through 1.10 enables unauthenticated remote attackers to cancel sales quotations, sales orders, purchase quotations, and purchase orders on behalf of authenticated users with order-management permissions, with no public exploit identified at time of analysis per KEV, though a publicly available exploit exists. The vulnerability stems from business-critical state-changing operations (CancelarOrcamentoVendaView, CancelarPedidoVendaView, CancelarOrcamentoCompraView, CancelarPedidoCompraView) being implemented inside HTTP GET handlers, which Django's CsrfViewMiddleware explicitly exempts from CSRF token enforcement. An upstream fix is available via GitHub PR #163 (GET-to-POST method migration), but a patched tagged release version has not been independently confirmed.
User enumeration in djangoSIGE through version 1.10 exposes valid account identities to unauthenticated remote attackers via the POST login/esqueceu/ password reset endpoint. The ForgotPasswordView returned distinct error messages depending on account state - 'not found in database,' 'user has no email registered,' or a success message - allowing systematic harvesting of valid usernames and email addresses. A publicly available proof-of-concept exploit exists; no CISA KEV listing at time of analysis.
Cross-site request forgery in djangoSIGE through 1.10 enables unauthenticated remote attackers to cancel sales quotations, sales orders, purchase quotations, and purchase orders on behalf of authenticated users with order-management permissions, with no public exploit identified at time of analysis per KEV, though a publicly available exploit exists. The vulnerability stems from business-critical state-changing operations (CancelarOrcamentoVendaView, CancelarPedidoVendaView, CancelarOrcamentoCompraView, CancelarPedidoCompraView) being implemented inside HTTP GET handlers, which Django's CsrfViewMiddleware explicitly exempts from CSRF token enforcement. An upstream fix is available via GitHub PR #163 (GET-to-POST method migration), but a patched tagged release version has not been independently confirmed.
User enumeration in djangoSIGE through version 1.10 exposes valid account identities to unauthenticated remote attackers via the POST login/esqueceu/ password reset endpoint. The ForgotPasswordView returned distinct error messages depending on account state - 'not found in database,' 'user has no email registered,' or a success message - allowing systematic harvesting of valid usernames and email addresses. A publicly available proof-of-concept exploit exists; no CISA KEV listing at time of analysis.