Session Fixation in amirsanni/mini-inventory-and-sales-management-system
Jun 19th 2021
Application does not destroy session cookie after log out. An attacker can use the old cookie of any user to to manipulate application data even after log out.
🕵️♂️ Proof of Concept
1. Login to the application and copy the session cookie from the request. 2. Now logout from the application. 3. Now use the same cookie to perform any critical action in the application. Application will still accept the old cookie.
If an attacker got any cookie by any mean then they can use those cookie to manipulate the application data on their behalf even if user change the password or logout the application.