CVE-2013-7137: Improper Authentication (CWE-287)
value: The "remember me" functionality in login.php in Burden before 1.8.1 allows remote attackers to bypass authentication and gain privileges by setting the burden_user_rememberme cookie to 1.
CWE description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CVSS v3 base score: 9.8
Published: 2014-01-26T01:55Z
Repository: https://github.com/joshf/Burden
Language: PHP
Files changed: login.php, logout.php
Commit date: 2013-12-18 12:54:03 +0000
Commit message: Remove remember me until i can think of a better solution. Closes #2

Diff: diff --git a/login.php b/login.php
index bc794ac..6cfa9f2 100644
--- a/login.php
+++ b/login.php
@@ -15,22 +15,10 @@ session_start();
 if (!$con) {
     die("Error: Could not connect to database (" . mysql_error() . "). Check your database settings are correct.");
 }
 
 mysql_select_db(DB_NAME, $con);
-    
-//If cookie is set, skip login
-if (isset($_COOKIE["burden_user_rememberme"])) {
-    $id = $_COOKIE["burden_user_rememberme"];
-    $getid = mysql_query("SELECT `id` FROM `Users` WHERE `id` = \"$id\"");
-    if (mysql_num_rows($getid) == 0) {
-        header("Location: logout.php");
-        exit;
-    }
-    $userinforesult = mysql_fetch_assoc($getid); 
-    $_SESSION["burden_user"] = $userinforesult["id"];
-}
 
 if (isset($_POST["password"]) && isset($_POST["username"])) {
     $username = mysql_real_escape_string($_POST["username"]);
     $password = $_POST["password"];
     $userinfo = mysql_query("SELECT `id`, `user`, `password`, `salt` FROM `Users` WHERE `user` = \"$username\"");
@@ -121,17 +109,10 @@ if (isset($_GET["login_error"])) {
 <label class="control-label" for="password">Password</label>
 <div class="controls">
 <input type="password" id="password" name="password" class="input-block-level" placeholder="Password...">
 </div>
 </div>
-<div class="control-group">
-<div class="controls">
-<label class="checkbox">
-<input type="checkbox" id="rememberme" name="rememberme"> Remember Me
-</label>
-</div>
-</div>
 <button type="submit" class="btn pull-right">Login</button>
 </fieldset>
 </form>
 </div>
 <!-- Content end -->
diff --git a/logout.php b/logout.php
index 55c7270..9061762 100644
--- a/logout.php
+++ b/logout.php
@@ -10,14 +10,10 @@ require_once("config.php");
 
 session_start();
 
 session_unset("burden_user");
 
-if (isset($_COOKIE["burden_user_rememberme"])) {
-	setcookie("burden_user_rememberme", "", time()-86400);
-}
-
 header("Location: login.php?logged_out=true");
 
 exit;
 
 ?>
\ No newline at end of file

Vulnerable code:     
//If cookie is set, skip login
if (isset($_COOKIE["burden_user_rememberme"])) {
    $id = $_COOKIE["burden_user_rememberme"];
    $getid = mysql_query("SELECT `id` FROM `Users` WHERE `id` = \"$id\"");
    if (mysql_num_rows($getid) == 0) {
        header("Location: logout.php");
        exit;
    }
    $userinforesult = mysql_fetch_assoc($getid); 
    $_SESSION["burden_user"] = $userinforesult["id"];
}
<div class="control-group">
<div class="controls">
<label class="checkbox">
<input type="checkbox" id="rememberme" name="rememberme"> Remember Me
</label>
</div>
</div>
if (isset($_COOKIE["burden_user_rememberme"])) {
	setcookie("burden_user_rememberme", "", time()-86400);
}