full-disclosure - [FD] Insufficient Session Cookie Invalidation in nopCommerce v4.10 and 4.80.3

Open Source and information security mailing list archives

Message-ID: <CAFmK-GzMOCmq5Z6YxpGAubTR_f4p+pNrh3amuiPxKQJowtaYFg@mail.gmail.com>
Date: Sun, 17 Aug 2025 22:48:22 -0400
From: Ron E <ronaldjedgerson@...il.com>
To: fulldisclosure@...lists.org
Subject: [FD] Insufficient Session Cookie Invalidation in nopCommerce v4.10
	and 4.80.3

nopCommerce v4.10 and 4.80.3 is vulnerable to Insufficient Invalidation of
Session Cookies. The application does not properly invalidate or expire
authentication cookies after logout or session termination.

An attacker who obtains a valid session cookie (e.g., via network
interception, XSS, or system compromise) can continue to use the cookie to
access privileged endpoints (such as /Admin) even after the legitimate user
has logged out. This flaw enables session hijacking and privilege
escalation, as the cookie remains valid beyond its intended lifecycle.

POST /Admin  HTTP/2
Host: <host>
Cookie: .Nop.Authentication=CfDJ8F***
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives