CVE-2023-40174 (published 2023-08-18T22:15Z)

Social media skeleton is an uncompleted/framework social media project implemented using a php, css ,javascript and html. Insufficient session expiration is a web application security vulnerability that occurs when a web application does not properly manage the lifecycle of a user's session. Social media skeleton releases prior to 1.0.5 did not properly limit manage user session lifecycles. This issue has been addressed in version 1.0.5 and users are advised to upgrade. There are no known workarounds for this vulnerability.\n\n

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-613
cwe_name: Insufficient Session Expiration
description: According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/fobybus/social-media-skeleton
commit_details: repo_url: https://github.com/fobybus/social-media-skeleton
author: fobybus
author_date: 2023-08-17 11:27:24-07:00
msg: added session expiration
repository: repo_url: https://github.com/fobybus/social-media-skeleton
repo_name: fobybus/social-media-skeleton
description: uncompleted social media project implemented using a php, css ,javascript and html
repo_language: PHP
owner: fobybus
file_changes: filename: add.php
change_type: ModificationType.MODIFY
diff: @@ -9,6 +9,13 @@ if(!isset($_SESSION["aid"]))
    exit();
 }
 
+ //is expired 
+ if(sexpired())
+ {
+    header("location:logout.php");
+    exit();
+ }
+
 if($_SERVER['REQUEST_METHOD'] == 'POST')
 {
   $uemail=htmlspecialchars($_POST["email"], ENT_QUOTES, 'UTF-8');

programming_language: PHP
filename: setting.php
change_type: ModificationType.MODIFY
diff: @@ -8,6 +8,14 @@ if(!isset($_SESSION["aid"]))
 	header("location:../adminlogin.html");
    exit();
 }
+
+ //is expired 
+ if(sexpired())
+ {
+    header("location:logout.php");
+    exit();
+ }
+ 
 //connect to the database first!!!!
 require('../../tasks/condb.php');
 if($_SERVER['REQUEST_METHOD'] == 'POST')

programming_language: PHP
filename: home.php
change_type: ModificationType.MODIFY
diff: @@ -1,12 +1,21 @@
 <!-- drop in and out of the PHP context -->
 <?php  
 include("atask/getinfo.php");
+include("../tasks/passw.php");
 session_start();
  if(!isset($_SESSION["aid"]))
  {
 	 header("location:adminlogin.html");
 	
  }
+
+ //is expired 
+if(sexpired())
+{
+   header("location:atask/logout.php");
+   exit();
+}
+
 ?> 
 
 <html lang="en-us">

programming_language: PHP
filename: login.php
change_type: ModificationType.MODIFY
diff: @@ -31,6 +31,7 @@ if($result->num_rows>0)
     $_SESSION["aid"]=$id;
     $_SESSION["password"]=$pass;
     $_SESSION["salt"]=$salt;
+    $_SESSION["exp_time"]=time()+(10);
    header("location:home.php");
   } else {
     echo "<p style='color:red;text-align:center;font-size:20px;'> incorrect password   </p>";

programming_language: PHP
filename: mg.php
change_type: ModificationType.MODIFY
diff: @@ -1,10 +1,19 @@
 <?php
 session_start();
+include("../tasks/passw.php");
 if(!isset($_SESSION["aid"]))
 {
 	header("location:adminlogin.html");
    exit();
 }
+
+ //is expired 
+ if(sexpired())
+ {
+    header("location:atask/logout.php");
+    exit();
+ }
+
 ?>
 <html lang="en-us">
 

programming_language: PHP
filename: login.php
change_type: ModificationType.MODIFY
diff: @@ -1,4 +1,4 @@
-<?php
+<?php   
 session_start();
 if(isset($_SESSION["id"]))
 {
@@ -39,7 +39,7 @@ if($result->num_rows>0)
   $upass=hashPass($upass,$salt);
   if($upass==$pas)
   {
-      //session start
+      //session start 
   $_SESSION['email']=$email;
   $_SESSION["id"]=$id;
   $_SESSION["fname"]=$fname;
@@ -51,6 +51,7 @@ if($result->num_rows>0)
   $_SESSION["edu"]=$edu;
   $_SESSION["joined"]=$joined;
   $_SESSION["salt"]=$salt;
+  $_SESSION["exp_time"]=time()+(10);
   ////////////////////////////
   //update last seen
   ////////////////////////////

programming_language: PHP
filename: passw.php
change_type: ModificationType.MODIFY
diff: @@ -14,4 +14,13 @@ function hashPass($plain,$salt)
     return hash("sha256",$password);
 }
 
+//check se exp 
+function sexpired()
+{
+  if(isset($_SESSION["exp_time"]) && $_SESSION["exp_time"]<time())
+   return true; 
+   else 
+   return false;
+}
+
 ?>
\ No newline at end of file

programming_language: PHP
filename: home.php
change_type: ModificationType.MODIFY
diff: @@ -1,11 +1,20 @@
 <!-- drop in and out of the PHP context -->
 <?php  
 session_start();
+require("../tasks/passw.php");
 if(!isset($_SESSION["id"]))
 {
 	header("location:../login.html");
 	exit();
 }
+
+//is expired 
+if(sexpired())
+{
+   header("location:logout.php");
+   exit();
+}
+
 ?> 
 
 <html lang="en-us">

programming_language: PHP
filename: profile.php
change_type: ModificationType.MODIFY
diff: @@ -1,11 +1,20 @@
 <!-- drop in and out of the PHP context -->
 <?php  
 session_start();
+require("../tasks/passw.php");
 if(!isset($_SESSION["id"]))
 {
 	header("location:../login.html");
 	die();
 }
+
+//is expired 
+if(sexpired())
+{
+   header("location:logout.php");
+   exit();
+}
+
 ?> 
 
 <html lang="en-us">

programming_language: PHP
filename: setting.php
change_type: ModificationType.MODIFY
diff: @@ -8,6 +8,12 @@ if (!isset($_SESSION["id"])) {
   exit();
 }
 
+//is expired 
+if(sexpired())
+{
+   header("location:logout.php");
+   exit();
+}
 
 
 if (isset($_POST["ch-info"])) {

programming_language: PHP