Subject: Ticket Assigned - Re: Bug Report
From: Babyshop <[email-masked]>
To: [email-masked]
Date: Thu, 17 Feb 2022 15:45:24 +0000

Hi Naif Teni,  A new ticket has been assigned to you. Please follow the link below to view the ticket.  Re: Bug Report Hi,
Have you any update on the reported bug?
Hope to hear from you today.
And I am hoping to receive a reward as a token of appreciation.

Kind Regards,

On Wed, 9 Feb 2022 at 09:15, Noman Sarwar <[email-masked]> wrote:

>    Hi,
>  As an Ethical Hacker
> Bug Found in your site : babyshopstores.com
>
> Bug Type: Session Management[Session invalidation ]
>
> Description of the issue-
>
> The server does not invalidate the previous session once the password is
> changed by the legitimate user.
>
> How to reproduce?-
>
> Login in to Your Account using firefox.
>
> Now login to the same  account using google chrome.
>
> Lets assume website user's account is compromised so he wants to change
> his password, he will navigate to forgot password page or simply password
> change page and will change his password in the chrome browser.
>
> Web user is able to change his password and the session from which the
> password changes is logged out but it was observed that still the previous
> session in firefox is not invalidated and i was actually able to browse
> the website from both the sessions.
>
> Impact-
> If the web user's account is compromised, he will simply change his
> password but if the previous session is not invalidated there is no use
> of changing the password.
>
> Remediation- Invalidate the previous session once the password has been
> changed and enforce the web user to relogin in the website.
>
> Waiting for your response......!!!!!!!!!!!!!!!!!!!!!!!!!!
>
> Regards
>

 https://landmarkgroupservice.freshdesk.com/helpdesk/tickets/3906699