Executive brief
Prospero Flow CRM is a customer relationship management platform used to manage sales orders and workflows. A design flaw in the order confirmation feature allows attackers to fraudulently confirm customer orders by tricking authenticated users into clicking a malicious link, causing unauthorized state changes to orders without the customer's knowledge or consent. Since order numbers are predictable, attackers can confirm all orders on the system in an automated attack.
Technical details
This is a Cross-Site Request Forgery (CSRF) vulnerability in the OrderConfirmController::confirm() endpoint, exposed at GET /order/confirm/{order_number}. The root cause is that the order confirmation route uses the HTTP GET method, which is not protected by Laravel's VerifyCsrfToken middleware (which only guards POST, PUT, PATCH, and DELETE requests). When an authenticated user visits an attacker-controlled page containing a link to this endpoint, their browser automatically includes session cookies with SameSite=Lax settings, allowing the attacker to trigger order state changes from pending to confirmed. Because order numbers are sequential integers, an attacker can enumerate and confirm all existing orders in an automated sweep. The vulnerability affects all versions before 5.15.11; the fix changes the route from GET to POST and adds CSRF token validation via the @csrf directive in the order confirmation form.
Affected products
- Roskus Prospero Flow CRM before 5.15.11
Timeline
- 2026-09-04: disclosed
- 2026-09-04: patched: Fix committed to main branch as a90c0c8c; version 5.15.11 not yet tagged or released