Description
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane omits ensure_valid_post_request() from delete methods including Payments::delete(), Recurring::delete(), and User_clients::delete(). Although the routes require POST, they do not validate the request's CSRF token. An attacker can submit a cross-origin form through an authenticated administrator's browser to delete financial records and other application data. This issue is fixed in version 1.7.2.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
InvoicePlane InvoicePlane
< 1.7.2affected
References
- https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-9372-vj68-hmc3 ↗
- https://github.com/InvoicePlane/InvoicePlane/pull/1637 ↗
- https://github.com/InvoicePlane/InvoicePlane/commit/215b8c1acca7560d00b7e463fb1c6fe98235ab95 ↗
- https://github.com/InvoicePlane/InvoicePlane/releases/tag/v1.7.2 ↗