#2 session vulnerability

[Anonymous]

code don't distroy the sessions so if you c/p your link to another user , attacker can log in to your account.

[LuckyLuke]

Logged In: YES
user_id=1300508
Originator: NO

Well, I thought I had an IP check, but I'm going to look into it.