Description

rosariosis has a vulnerability that allows user to return to a page containing personally identifiable information (PII) and sensitive information even after logging out of the application by using the browser’s back button. This issue poses a significant risk to the confidentiality of sensitive data and user privacy.

Steps to reproduce

1. Login to rosariosis and navigate to pages that displays PII
   example = /Modules.php?modname=Users/User.php&category_id=1&staff_id=4
2. Log yourself out from the application
3. Pressed the browser’s back button and it will return to the page that the user visited recently

Recommendations:

Please check owasp reference for the fixes
https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/04-Authentication_Testing/06-Testing_for_Browser_Cache_Weaknesses