Executive brief
djangoSIGE, an open-source enterprise resource planning (ERP) system, is vulnerable to a security flaw that allows unauthorized individuals to cancel sales or purchase orders. By tricking a logged-in staff member into visiting a malicious website or clicking a link, an attacker can silently trigger order cancellations without the user's knowledge. This could disrupt business operations, interfere with supply chains, and damage a company's financial records.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in djangoSIGE through version 1.10 (commit a6fe7e8). The root cause is the implementation of state-changing logic (order cancellation) within HTTP GET method handlers in views such as CancelarOrcamentoVendaView and CancelarPedidoVendaView. Because Django's CsrfViewMiddleware only enforces CSRF protection on 'unsafe' methods (POST, PUT, PATCH, DELETE), these GET-based endpoints bypass validation entirely. An attacker can exploit this by luring an authenticated user with appropriate permissions to a page containing a cross-origin reference, such as an <img> tag, pointing to the cancellation URL. A fix has been proposed in pull request #163 which moves the logic to POST handlers and implements proper CSRF tokens.
Affected products
- thiagopena djangoSIGE through 1.10 (commit a6fe7e8)
Timeline
- 2026-07-21: advisory: NVD and VulnCheck published the advisory
- 2026-07-21: patched: Pull request with fix submitted to the repository