-2

I am testing one web application build using PHP. I found one vulnerability in which multiple user can log-in using same browser, without destroying others session. What this sort of vulnerabilities are called and what is the effect of this vulnerability? Many times it happens I find some vulnerabilities, but unable to hack into it, acunetix vulnerability scanner showed this software is vulnerable to blind injection, but I don't know what to do after that.Any readings or advise for that?

2

What you describe is not in and of itself a vulnerability. However, if logging in does not completely over-write client-side session information (eg. cookies or other persistent storage), or if elements of the session are tied to the client's IP address, there is the potential for a privilege-escalation or session hijacking attack.

1

I generally inform my clients about the multiple login "issue", especially when there is no last logon information available. Is it a vulnerability? Personally, I don't think it is, it could be a feature where a client sometimes requires to be logged in multiple times (due to poor application development for example). I call this finding "Simultaneous login is enabled" or "Multiple login is enabled".

Whenever Acunetix discovers any form of SQL injection, the next step is to verify it.

Depending on the type of SQL injection, I generally do it by hand. Unless it's timed based blind, I use sqlmap.

In case of just blind sql injection, I'd recommend to perform an action such as the following example:

?id=23 and 1=1 <-- which is a true statement and you should see what ever is displayed when id 23 is requested normally.

?id=23 and 1=2 <-- which is false, sometimes returns a white screen.

If this doesn't work, try using sqlmap.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.