# Vulnerability Summary ## Overview - **Vulnerability ID**: #800691 - **Vulnerability Name**: code-projects Invoice System in Laravel 1.0 Cross-Site Request Forgery (CSRF) + Weak Session Handling - **Vulnerability Type**: Cross-Site Request Forgery (CSRF) + Weak Session Handling - **Submitted By**: c4m1c4k (UID 75518) - **Submission Time**: 2020-04-09 03:47 AM - **Review Time**: 2020-04-29 04:45 PM - **Status**: Verified - **VulDB Entry**: [code-projects Invoice System in Laravel 1.0 cross-site request forgery](https://vuldb.com/?id.800691) ## Impact Scope - **Affected Systems**: code-projects Invoice System in Laravel 1.0 - **Vulnerability Description**: The logout functionality is implemented via a GET request and does not require a CSRF token. An attacker can trick a victim into clicking a link or loading a malicious image tag, forcing the victim to log out of the application. ## Remediation - **Recommended Measures**: 1. Change the logout functionality from a GET request to a POST request. 2. Add CSRF token validation to the logout request. 3. Ensure secure session management to avoid weak session handling. ## POC Code - **Source Link**: [https://gist.github.com/higordiegodev25a1b65d938f8da2e806bcdc031a1b](https://gist.github.com/higordiegodev25a1b65d938f8da2e806bcdc031a1b)