javahuang / SurveyKing

Make a better survey system.
https://surveyking.cn
MIT License
3.34k stars 506 forks source link

Old session can be used after changing password #56

Open menghaining opened 6 months ago

menghaining commented 6 months ago

Description

Suffering from CWE-613(insufficent session expiration). When user changing password, system not acquire user to re-login. The old session can be used to modify user information.

Affacted version:

v1.3.1, also the version in the latest docker version

updated at Nov 10, 2022

POC:

  1. user login

  2. user change password

    image
  3. old session can be used to modify user's information and success.

    image