WS-2023-0332

Account takeover is possible via password reset in alovoa. An attacker finds out the victim’s email address or attacks [email protected] for more impact. The attacker obtains their password reset token from the application via email. The random seed can be cracked in about 2 hours and used to...

Session Fixation in alovoa/alovoa

✍️ Description When a logged in user changes his password, the session does not expire after the update. 🕵️‍♂️ Proof of Concept // PasswordController.java does not expire or force to logout the user after the update. @PostMappingvalue = "/change", consumes = "application/json" public void...