## Title:  textpattern-4.8.8 Session token in URL Vulnerability
## Author: nu11secur1ty
## Vendor:
## Software:
## Reference:,

## Description:
Sensitive information within URLs may be logged in various locations,
including the user's browser, the web server, and any forward or
reverse proxy servers between the two endpoints. URLs may also be
displayed on-screen, bookmarked or emailed around by users. They may
be disclosed to third parties via the Referer header when any off-site
links are followed. Placing session tokens into the URL increases the
risk that they will be captured by an attacker.
Issue detail: The URL in the request appears to contain a session
token within the query

STATUS: Medium Vulnerability

GET /textpattern-4.8.8/textpattern/index.php?event=diag HTTP/1.1
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.138
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: txp_login=Admin%2C628717737574e8be05624bb2da74fb38;
Connection: close

HTTP/1.1 200 OK
Date: Wed, 10 May 2023 07:51:37 GMT
Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/7.4.30
X-Powered-By: PHP/7.4.30
Content-Security-Policy: frame-ancestors 'self'
X-Frame-Options: SAMEORIGIN
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 10725

<!DOCTYPE html>
<html lang="en" dir="ltr">
<meta charset="utf-8">
<meta name="robots" content="noindex, nofollow">
<title>Diagnostics - My site | Textpattern CMS</title>
<script src="vendo
<input name="event" type="hidden" value="diag" /><a rel="external
noopener" target="_blank"
configuration <span class="ui-icon ui-icon-extlink">

## Reproduce:

## Proof and Exploit:

## Time spend: