Since I write an API for a website, I'm interested in his login system and his requests but something bothered me, I have the impression that the security system is weak...
When I login, I send POST request containing the login form, but my login cookie is plain text saved ( maybe insecurly deserialized ) ->
After successful login, the website starts the session: it defines some variable/functions, it's the first thing it does for any user loading. One of these variables is a random 40 string characters, used to validate user requests during the session. This string changes each time the session is loaded.
This website uses AJAX to format POST request. They are sent unencrypted, it's possible to intercept, edit, then send requests without problems. Typical POST request looks like:
POST https://www.website.fr/dataprocess/ HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Content-Length: 0 Host: www.website.fr logic=[COMMAND]&you=[USERNAME]&key=[SESSION KEY]
I edited the request to remove every useless elements, in fact this POST can be accepted by the server if I fill bracket with the right data.
Real request body to illustrate what kind of data I send (copy/pasted from wireshark) :
I decided to play around by editing request to see what was going to happen:
1 - Legit request with "key" string modified
2 - Legit request with fake username for "you" variable
Result: Empty Response
3 - Legit request with real username but not mine
I assume that this user has a different language than mine configured on his account...
According bug logs
The request body is interpreted by PHP (array function) - Unknown version
Is there a risk that a maliciously crafted request, in any way, can bypass the key argument and control accounts arbitrarily? Especially knowing that PHP array() (and maybe serialize()) function are used...