#23 Insecure Session

Johannes Pahl — Thu, 19 Apr 2018 06:56:58 -0000

How would you correct this?
< $ur = "index.php?login=y&q=".base64_encode(querystr());

$ur = "index.php?login=y";

Insecure Session

L3b-r1'z — Sat, 30 Jun 2012 07:08:39 -0000

Hello :D

I'm L3b-r1'z Bug Researcher :)

i found an bug in your last version of your project :D

look to file named config

if(!session_is_registered('phpcsl') &&
!isset($_GET['login']) && isset($_GET['act'])) {

if(!$_GET['act'] == "session") {
$ur = "index.php?login=y&q=".base64_encode(querystr());
header("Location: $ur");

your session is danger here :D

an attacker can add or edit or delete just to add in url

attacker can add every thing without logged in to your project :D

Please Relase it before i share it :)

Contact : L3br1z@Gmail.com

Peace