EUVD-2026-41737
GHSA-4957-h36g-34j9
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable but requires a prior authenticated session token (PR:L); limited confidentiality and integrity impact via session hijacking, no availability consequence.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was identified in SourceCodester Online Boat Reservation System 1.0. Affected by this vulnerability is an unknown functionality. Such manipulation leads to session expiration. It is possible to launch the attack remotely. The exploit is publicly available and might be used.
AnalysisAI
Insufficient session expiration in SourceCodester Online Boat Reservation System 1.0 allows a remote, low-privileged attacker to reuse a previously issued session token after it should have been invalidated, gaining unauthorized access to authenticated application functionality. The CWE-613 root cause indicates the application fails to properly terminate sessions on logout or timeout. A publicly available exploit demonstrates the flaw, as confirmed by a Medium writeup linked in the references.
Technical ContextAI
CWE-613 (Insufficient Session Expiration) describes a class of flaws where a web application does not properly invalidate session identifiers after logout or inactivity. The affected product - SourceCodester Online Boat Reservation System 1.0 - is a PHP-based open-source reservation management application distributed via SourceCodester.com, a site known for providing academic/demo PHP projects. The CPE string cpe:2.3:a:sourcecodester:online_boat_reservation_system:*:*:*:* uses a wildcard version field, suggesting the flaw may affect all released versions. The vulnerability lies in the session lifecycle management: session tokens are not server-side invalidated upon logout or expiry, allowing stale tokens to remain usable. This is a server-side flaw - client-side cookie deletion is insufficient because the server still honors the old token.
RemediationAI
No vendor-released patch or official security advisory has been identified at the time of analysis. The source code is available via SourceCodester.com, so operators should apply a direct code fix: implement server-side session destruction on logout using session_destroy() and session_unset() in PHP, and configure a server-enforced session timeout via session.gc_maxlifetime in php.ini. Regenerate session IDs on privilege changes using session_regenerate_id(true). As a compensating control, restrict access to the application to trusted internal networks or VPN, reducing the remote attack surface; note this limits usability for internet-facing reservation use cases. Setting short session timeouts (e.g., 15-30 minutes of inactivity) reduces the window of exploitation but does not eliminate the flaw. Monitor session logs for concurrent use of the same session token from multiple IP addresses as a detection signal.
A vulnerability has been found in SourceCodester/code-projects Online Boat Reservation System 1.0 and classified as prob
Improper authorization across multiple administrative endpoints in SourceCodester Online Boat Reservation System 1.0 all
Same weakness CWE-613 – Insufficient Session Expiration
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today