Vulnerability Report-Broken Authentication

[talha shahid]

Hey Team,

I'm a penetration tester and bug bounty hunter. I have discovered multiple vulnerabilities on your site. I've reported one of my findings so that you can review it, as well as fix this issue.

Please review the report below.

Vulnerability: Broken Authentication & Session Management
We have observed that when we change "password" from one browser in place of session expiration from another browser it just updates the password from another browser and the old session gets updated without being logged out. The flows goes like this:
Broken Authentication and Session Management > Failure to Invalidate Session > On Password Change
Steps:
1- Login from two browsers at a time [From Chrome browser and from Mozilla Firefox].
2- Change password in settings from chrome browser.
3- Now Check Mozilla Firefox.
4- Your Session got "updated" in place of expiration.

Same goes with when using two different computer systems.
1- Login from two computers at a time
2- Change password in settings from computer A.
3- Now Check computer B.
4- Your Session got "updated" in place of expiration.

Recommendations: If Session is Updating from one Browser/Computer so other should expire first to renew session after login.

If you require any additional information, please let me know. I'll be waiting to hear from your side regarding the report and bounty. I'll share my other findings as well, once I've heard back from you.

Regards,

[Tomas M]

This is very interesting spam, just ignore

Tomas M

Dne čt 7. 9. 2023 4:06 uživatel talha shahid <shahidt...@gmail.com> napsal:

--
You received this message because you are subscribed to the Google Groups "Slax users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to slax-users+...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/slax-users/CAMz7wKkUqn%2BoVUY0DqaCo0Ag0Oxmh49TQD0dO58J42PGJQ0i%2Bw%40mail.gmail.com.

[talha shahid]

Hi Team,

Can I have an update regarding the bounty for the reported vulnerability?

[talha shahid]

Hi Team,

I believe that you have had an opportunity to read our previous email regarding the vulnerability report. As it's been long already and your team hasn't responded to the vulnerability report submitted by me, I was expecting $500 for responsible disclosure of vulnerability.

Furthermore I would like to publicly disclose vulnerability reports on our blogs for research and educational purposes. If you have any concerns do let me know.

[Kaldiaris Arteas]

he still working on it... hahaha...

sorryy.. hahaha

[talha shahid]

Hi,

It's been so long and I haven't heard any update from your side. Can I have an update regarding the bounty?

[talha shahid]

Hi Team,

I hope you are doing well.

Any update regarding the report vulnerability and bounty ?

Waiting for your reply.

Thank you.