CyberRota Analysis
AI-GeneratedThe vulnerability allows attackers to maintain authenticated access to Question2Answer systems by exploiting a flaw in the forgot-password reset process, which fails to invalidate the sessioncode associated with previously issued remember-me cookies. This oversight means that even after a password reset, an attacker can continue to access the account if they possess a valid persistent cookie. Organizations using Question2Answer versions up to 1.8.8 should prioritize remediation to prevent unauthorized access to user accounts.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Question2Answer through 1.8.8 contains a session invalidation vulnerability that allows attackers with a previously obtained remember-me cookie to retain authenticated access by exploiting the forgot-password reset flow's failure to clear the sessioncode field in qa-include/app/users-edit.php. While the normal password-change flow in qa-include/pages/account.php explicitly clears the sessioncode to invalidate persistent qa_session cookies, the forgot-password handler qa_finish_reset_user() omits this step, allowing any valid persistent cookie issued before the reset to continue authenticating the account after the password reset completes.