CVE-2023-40174: Insufficient Session Expiration (CWE-613)
value: Social media skeleton is an uncompleted/framework social media project implemented using a php, css ,javascript and html. Insufficient session expiration is a web application security vulnerability that occurs when a web application does not properly manage the lifecycle of a user's session. Social media skeleton releases prior to 1.0.5 did not properly limit manage user session lifecycles. This issue has been addressed in version 1.0.5 and users are advised to upgrade. There are no known workarounds for this vulnerability.


CWE description: According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
CVSS v3 base score: 9.8
Published: 2023-08-18T22:15Z
Repository: https://github.com/fobybus/social-media-skeleton
Language: PHP
Files changed: admin/atask/add.php, admin/atask/setting.php, admin/home.php, admin/login.php, admin/mg.php, login.php, tasks/passw.php, user/home.php, user/profile.php, user/setting.php
Commit date: 2023-08-17 11:27:24 -0700
Commit message: added session expiration

Diff: diff --git a/admin/atask/add.php b/admin/atask/add.php
index 8d5f729..e354ad3 100644
--- a/admin/atask/add.php
+++ b/admin/atask/add.php
@@ -7,10 +7,17 @@ if(!isset($_SESSION["aid"]))
 {
 	header("location:../adminlogin.html");
    exit();
 }
 
+ //is expired 
+ if(sexpired())
+ {
+    header("location:logout.php");
+    exit();
+ }
+
 if($_SERVER['REQUEST_METHOD'] == 'POST')
 {
   $uemail=htmlspecialchars($_POST["email"], ENT_QUOTES, 'UTF-8');
   $upass=$_POST["password"];
 
diff --git a/admin/atask/setting.php b/admin/atask/setting.php
index 670ae39..f1caf4c 100644
--- a/admin/atask/setting.php
+++ b/admin/atask/setting.php
@@ -6,10 +6,18 @@ require("../../tasks/validate.php");
 if(!isset($_SESSION["aid"]))
 {
 	header("location:../adminlogin.html");
    exit();
 }
+
+ //is expired 
+ if(sexpired())
+ {
+    header("location:logout.php");
+    exit();
+ }
+ 
 //connect to the database first!!!!
 require('../../tasks/condb.php');
 if($_SERVER['REQUEST_METHOD'] == 'POST')
 {
 
diff --git a/admin/home.php b/admin/home.php
index c3c68d2..4e2188c 100644
--- a/admin/home.php
+++ b/admin/home.php
@@ -1,14 +1,23 @@
 <!-- drop in and out of the PHP context -->
 <?php  
 include("atask/getinfo.php");
+include("../tasks/passw.php");
 session_start();
  if(!isset($_SESSION["aid"]))
  {
 	 header("location:adminlogin.html");
 	
  }
+
+ //is expired 
+if(sexpired())
+{
+   header("location:atask/logout.php");
+   exit();
+}
+
 ?> 
 
 <html lang="en-us">
 
 <head>
diff --git a/admin/login.php b/admin/login.php
index fa2bf61..df95078 100644
--- a/admin/login.php
+++ b/admin/login.php
@@ -29,10 +29,11 @@ if($result->num_rows>0)
   {
     session_start();
     $_SESSION["aid"]=$id;
     $_SESSION["password"]=$pass;
     $_SESSION["salt"]=$salt;
+    $_SESSION["exp_time"]=time()+(10);
    header("location:home.php");
   } else {
     echo "<p style='color:red;text-align:center;font-size:20px;'> incorrect password   </p>";
    require('adminlogin.html');
   }
diff --git a/admin/mg.php b/admin/mg.php
index 9563dfc..f01928f 100644
--- a/admin/mg.php
+++ b/admin/mg.php
@@ -1,12 +1,21 @@
 <?php
 session_start();
+include("../tasks/passw.php");
 if(!isset($_SESSION["aid"]))
 {
 	header("location:adminlogin.html");
    exit();
 }
+
+ //is expired 
+ if(sexpired())
+ {
+    header("location:atask/logout.php");
+    exit();
+ }
+
 ?>
 <html lang="en-us">
 
 <head>
     <title> admin homepage </title>
diff --git a/login.php b/login.php
index 4338012..0443bbf 100644
--- a/login.php
+++ b/login.php
@@ -1,6 +1,6 @@
-<?php
+<?php   
 session_start();
 if(isset($_SESSION["id"]))
 {
 	header("location:user/home.php");
   exit();
@@ -37,11 +37,11 @@ if($result->num_rows>0)
 
   //checking 
   $upass=hashPass($upass,$salt);
   if($upass==$pas)
   {
-      //session start
+      //session start 
   $_SESSION['email']=$email;
   $_SESSION["id"]=$id;
   $_SESSION["fname"]=$fname;
   $_SESSION["lname"]=$lname;
   $_SESSION["bday"]=$bd;
@@ -49,10 +49,11 @@ if($result->num_rows>0)
   $_SESSION["gender"]=$gender;
   $_SESSION["password"]=$pas;
   $_SESSION["edu"]=$edu;
   $_SESSION["joined"]=$joined;
   $_SESSION["salt"]=$salt;
+  $_SESSION["exp_time"]=time()+(10);
   ////////////////////////////
   //update last seen
   ////////////////////////////
   $sessionID =   session_id();
   session_write_close();
diff --git a/tasks/passw.php b/tasks/passw.php
index 6367d51..7d8970b 100644
--- a/tasks/passw.php
+++ b/tasks/passw.php
@@ -12,6 +12,15 @@ function hashPass($plain,$salt)
 {
     $password=$plain.$salt;
     return hash("sha256",$password);
 }
 
+//check se exp 
+function sexpired()
+{
+  if(isset($_SESSION["exp_time"]) && $_SESSION["exp_time"]<time())
+   return true; 
+   else 
+   return false;
+}
+
 ?>
\ No newline at end of file
diff --git a/user/home.php b/user/home.php
index c011e9e..bcb85aa 100644
--- a/user/home.php
+++ b/user/home.php
@@ -1,13 +1,22 @@
 <!-- drop in and out of the PHP context -->
 <?php  
 session_start();
+require("../tasks/passw.php");
 if(!isset($_SESSION["id"]))
 {
 	header("location:../login.html");
 	exit();
 }
+
+//is expired 
+if(sexpired())
+{
+   header("location:logout.php");
+   exit();
+}
+
 ?> 
 
 <html lang="en-us">
 
 <head>
diff --git a/user/profile.php b/user/profile.php
index e95302a..bbf576d 100644
--- a/user/profile.php
+++ b/user/profile.php
@@ -1,13 +1,22 @@
 <!-- drop in and out of the PHP context -->
 <?php  
 session_start();
+require("../tasks/passw.php");
 if(!isset($_SESSION["id"]))
 {
 	header("location:../login.html");
 	die();
 }
+
+//is expired 
+if(sexpired())
+{
+   header("location:logout.php");
+   exit();
+}
+
 ?> 
 
 <html lang="en-us">
 
 <head>
diff --git a/user/setting.php b/user/setting.php
index 3b4421c..51e52e8 100644
--- a/user/setting.php
+++ b/user/setting.php
@@ -6,10 +6,16 @@ session_start();
 if (!isset($_SESSION["id"])) {
   header("location:../login.html");
   exit();
 }
 
+//is expired 
+if(sexpired())
+{
+   header("location:logout.php");
+   exit();
+}
 
 
 if (isset($_POST["ch-info"])) {
   $fname = htmlspecialchars($_POST["fname"], ENT_QUOTES, "UTF-8");
   $lname = htmlspecialchars($_POST["lname"], ENT_QUOTES, "UTF-8");

Vulnerable code: <?php
      //session start
Fixed code:  //is expired 
 if(sexpired())
 {
    header("location:logout.php");
    exit();
 }


 //is expired 
 if(sexpired())
 {
    header("location:logout.php");
    exit();
 }
 
include("../tasks/passw.php");

 //is expired 
if(sexpired())
{
   header("location:atask/logout.php");
   exit();
}

    $_SESSION["exp_time"]=time()+(10);
include("../tasks/passw.php");

 //is expired 
 if(sexpired())
 {
    header("location:atask/logout.php");
    exit();
 }

<?php   
      //session start 
  $_SESSION["exp_time"]=time()+(10);
//check se exp 
function sexpired()
{
  if(isset($_SESSION["exp_time"]) && $_SESSION["exp_time"]<time())
   return true; 
   else 
   return false;
}

require("../tasks/passw.php");

//is expired 
if(sexpired())
{
   header("location:logout.php");
   exit();
}

require("../tasks/passw.php");

//is expired 
if(sexpired())
{
   header("location:logout.php");
   exit();
}

//is expired 
if(sexpired())
{
   header("location:logout.php");
   exit();
}