SecurityInnovation/TMContentReview — Issue #199: Secure the Account Administration Functionality
Author: SergeTruth
Created: 2011-11-07 23:26:51+00:00
State: open

"If a privileged user's account is being compromised via session hijacking in the main application interface, the attackers would still need the user's credentials before accessing the administrative interface and compromising the other users' accounts."
If a privileged user's session has been compromised via session hijacking I don't understand how the attacker would still need the user's credentials.

"The following code shows the navigation bar for an administrative account of the application. Because the administrative code is separated from the application via server directory and server port, an administrator would need to use two distinct sessions to use and administer the application. Therefore, a vulnerability such as cross-site scripting in the main application interface will not expose the administrative interface."
Unless the user is logged into both his user and admin accounts.