Session might persist after server-side token deletion #2

New issue

Open

opened 2023-07-05 21:35:48 +00:00 by LunarTides · 0 comments

LunarTides commented

2023-07-05 21:35:48 +00:00

(Migrated from github.com)

AFAIK, this only happens if the attacker directly injects the token cookie, instead of logging in.

This might have something to do with the fact that 'header.php', which handles this, creates a warning on newer versions of php / xampp / mysql.

A session created from a cookie might persist after the token gets deleted. This can be exploited if an attacker grabs the token from another user, and even if the original user logs out (which deletes the token) the attacker remains logged in. AFAIK, this only happens if the attacker directly injects the token cookie, instead of logging in. This might have something to do with the fact that 'header.php', which handles this, creates a warning on newer versions of php / xampp / mysql.

Commenting is not possible because the repository is archived.