quote:

---

OK. I'll give you the full story from scratch, and you can take what you need.

MrsModerator is a personal friend of mine, and has at some point in the recent past used my computer to log into this site. I know that she did not use the 'remember me' function, because when I have occasionally visited the site to read a particular thread in the forums regarding MrsModerators book, she has not been logged in, and at this point I didn't even have my own account.

Early in the morning, 1st January, I Googled for the thread. I visited the boards from the link on google, and there was as to be expected, nobody logged in. I know this as I clicked the reply link and was told that I needed to register, as you'd expect.

Anyway, I entered my details, and registered as NewMember1. When I clicked the link/button to submit my details, I was redirected to the 'verification email sent' page, and asked to check my email inbox. As I opened a new window and browsed to my email, the internet explorer page open to the 'verification email' page changed, and when I looked, I was logged on as MrsModerator on a page that listed problems with my registration details in every field. Given that I am now registered with those exact details, from that email, I suspect that this page wasn't referring to my details, but instead was referring to a submittal that didn't exist.

On seeing this, I was quite shocked. My only theory is that the page that loaded called on a cookie placed in my temporary internet files from when Jan logged in, even though she hadn't used the remember me function.

I went to the Moderators forum with MrsModerator's account, (I did not read any messages, and don't remember any post titles. It was none of my business. I'm more honest than that, and I was out to explore and prove a vulnerability so that I could report it accurately.), and I posted a message with a title along the lines of 'problem with my account/test' and giving a brief, vague content, explaing that I (IE, MrsModerator) would delete it later, as I didn't want to get MrsModerator into trouble. After all, this was not her fault, I didn't know at the time why it had happened, and I didn't want her to get into trouble for nothing. I posted for two reasons. First, to see if it was possible, and secondly, to prove that the problem existed.

After that, I immediately logged out of MrsModerator's account, and logged into my own before posting a message on the thread I had originally set out to post to - the one I had Googled for - in the Off-Topic Forum.

I then logged out of my account, closed the window, and came back to the site. I was still logged out (under my own name). I had not checked 'remember me' before I had left.

I searched my temporary internet files for links in *********.org.uk (URL removed for privacy of site. I am not a staff member) and found many, so I tried them out one by one.

Eventually, I opened...

http://*********.org.uk/forums/register.asp?mode=DoIt

...from my temporary internet files which brought me to the registration error page again, with one subtle difference, I was logged in as myself again. I immediately logged out, and to check I wouldn't be logged back in when I next clicked a link or refreshed, I clicked the profile link. I was told I needed to register, proving that I was logged out.

I then went back to the file "register.aspmode=DoIt" in my temporary internet files which points to http://*********.org.uk/forums/register.asp?mode=DoIt , I opened it, and it brought me back to the registration error page, with me being logged in as myself.

The only explanation I can think of is that this link, and this link alone, loads login details from a cookie placed on the local machine during the last standard (non-remembered) login, and logs in the last user to access the site. Obviously, this is a security hazard, for example if a moderator, administrator, or user were to use a friends or a public computer to access the site.

I realise that some people being told this may consider that it wasn't a problem untill I brought it up, but I trust you will understand that I brought this up because it is always possible that someone else less honest than myself might otherwise work it out at a later date and wreak havoc with it. Obviously, that's not something I'd like to see.

The URL that I believe to be causing the problem is the one I mentioned, http://*********.org.uk/forums/register.asp?mode=DoIt , and as I said, it seems this link misbehaves by logging in the last user to visit the forums from a given machine.


Hope this helps.

---

quote:

---

Hi - thanks for the detailed explanation. It sounds like a caching issue where a page that logs someone in (such as register.asp) can just be refreshed / recalled from the temporary internet files cache and made to log someone in again.

Although, for this particular one I would have expected it only to work if the user registered on that particular computer - I dont know if that was the case or not?

Anyway, I didnt write the forum software - and dont really have much time to look into it further so I`ll just tell Administrator1 to warn the Moderators that they should avoid logging into the forums from "strangers" computers (ie. internet cafes etc..).

Thanks for making me aware of it anyway!

Cheers,
Administrator2

---

quote:

---

I'm afraid I don't know whether MrsModerator1 first registered on my machine or not. I'd have to ask. However, it was quite some time ago when MrsModerator registered with this forum, and my machine has undergone a full format within the last 4 months, and the temporary internet files have been cleared a number of times, both from Internet Explorer, and by visiting c:/documents and settings/%user%/local settings/temporary internet files/content.IE5 and deletinhg files and folders directly. If this is where the previous login information is coming from, MrsModerator1 must have last logged in from my machine since I last cleared these files. This is what leads me to believe that this is a cookie issue, rather than an issue which can only arise when the user logged in by this bug has originally registered from a particular local machine.

---