There is a sign-in form on the website, which submits login/password via POST method. Problem is, that code, which accepts login/password and authenticate user also accepts it via GET method (also, if user was logged in previously - user logged out and logged in as new user).
Question 1: Is that considered secure? Looks like no. Logged-in user could do some important operation in the account (fill a form with personal data, change password, upload some private data), during that an attacker could load hidden GET image on attacker' site and this image with re-login victim to attacker's account. So victim will upload private data into attacker's account.
However I cannot find evidences that it's considered unsecure or that it's a known forgery type.
Question 2: How this attack called? Where can I find info about it?
ATTENTION: In my question form submited via POST, but attacker construct a GET link (with attackers' password in GET). So it's not about designing application which submits password via GET.