Failure to Invalidate Cookie

[aashiqahamedn]

Name of the Affected Product:
Reportico

Affected Version:
Till 8.1.0

Vulnerability Scenario: Failure to Invalidate Cookie

Affected URL:
http://localhost/reportico-8.1.0/*
http://localhost/reportico-8.1.0/run.php?execute_mode=PREPARE&xmlin=qqqq.xml&reportico_session_name=joaacmh13taksmr7rg9to1cr3a_reportico&reportico_template=&reportico_ajax_called=1

Description:
This vulnerability arises from the failure of the web application to properly invalidate session cookies upon logout. When a user logs out of the application, the session cookie should be invalidated to prevent unauthorized access. However, due to the oversight in the application's implementation, the session cookie remains active even after logout. Consequently, if an attacker obtains the session cookie, they can exploit it to access the user's session and perform unauthorized actions.

Business Impact:
The failure to invalidate session cookies poses significant risks to the security and integrity of the application and its users' data. Attackers could exploit this vulnerability to impersonate legitimate users, access sensitive information, manipulate data, and compromise the overall security posture of the system. The potential consequences include financial loss, reputational damage, regulatory penalties, and legal liabilities for the affected organization.

Solution:
To mitigate the risk of failure to invalidate cookies, the application should implement proper session management practices. Upon logout, ensure that all session cookies are invalidated and cannot be reused.