| 제목 | Mstfakts College-Management-System 82ab01d057d96c8893c419cd9cb6870120faaea3 Session Expiration |
|---|
| 설명 | The affected logout handler is `Front-end/server.php:125-129`. When `log_out` is submitted, the code emits a JavaScript redirect but does not call `session_unset()`, `session_destroy()`, `setcookie()`, or any server-side session revocation mechanism:
```php
if (isset($_POST['log_out']))
{
echo "<script type='text/javascript'>alert('Login Success, Welcome);
window.location.href='login.php'; </script>";
}
```
The session started at `Front-end/server.php:2` continues to contain `$_SESSION['email']`. The same `PHPSESSID` remains accepted after logout and `Front-end/profile.php:47-52`, `Front-end/student.php:72-176`, and `Front-end/profileLecturer.php:64-75` continue to use it as an authenticated identity. A copied or retained session token therefore survives a user logout and continues to disclose protected information or perform authenticated actions. |
|---|
| 원천 | ⚠️ https://github.com/Mstfakts/College-Management-System/issues/7 |
|---|
| 사용자 | wemen99 (UID 99985) |
|---|
| 제출 | 2026. 07. 20. AM 11:57 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 09. 05. PM 09:02 (2 months later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 399351 [Mstfakts College-Management-System Logout Front-end/server.php log_out 약한 인증] |
|---|
| 포인트들 | 20 |
|---|