Authenticated privilege escalation via unrestricted role assignment

Improper authorization in Code Projects Invoice System in Laravel 1.0 allows remote authenticated users to grant accounts administrator privileges. The /user routes lack admin-only middleware, and the controller accepts attacker-controlled role values during account creation or modification. Any ordinary account can assign the admin role, gaining access to administrative functions and other users' accounts.