0

On my site, I restrict access to forms through assigning a $_SESSION['id'] if they are logged in.

If there is no $_SESSION['id'], to form page will redirect to a login page.

But I ran burpsuite on my site, and it had access to these forms when I spider'd my domain. BURP was even able to submit POST data, and it wound up appearing in my database.

Is there a term for this, and how can I stop it?

1

Assuming that your $_SESSION['id'] is a random long string that cannot be guessed (that would be a security issue) you need to validate at server side when a POST request comes in that it has a VALID session ID and the account is authorized for the functionality.

Now someone can bypass your authentication with Parameter tampering as you most likely only check if an ID is present and not if it is authorized for the action.

Check the following links and do some googling:

OWASP Session Management Cheat Sheet

OWASP authentication cheat sheet

0

Redirecting is not enough as a security measure. You need to actually stop the script execution.

Browsers are free to ignore a redirect request, and all the data will be send to the browser regardless (you do not see it though, as you are redirected).

This issue does not only affect POST requests, but also GET requests. It means that your whole authentication process can currently be bypassed (you cannot access resources that are bound to a specific session though).

You need to die after the redirect to fix the issue.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.