Language: PHP
Label: vulnerable
CWE: CWE-384 \u2014 Session Fixation
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

Code:
    public function logout()
    {
        unset($_COOKIE['BOXADMR']);
        $this->di['session']->delete('admin');
        $this->di['logger']->info('Admin logged out');

        return true;
    }