GHSA-qv5j-rwq3-m823
ThinkAdmin Administrator cookies still working after password change
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | zoujingli/thinkadmin | 4.0 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
`application\admin\controller\User.php` in ThinkAdmin V4.0 does not prevent continued use of an administrator's cookie-based credentials after a password change.
References
External links from the advisory. They lead to third-party sites.