Vuln: ability to access/modify arbitrary user's full information from another user's session

[talbenari1]

To preface this: yes, I'm aware that this is a sample application that's not designed to be secure or anything like that (y'know, what with the auto-filled default values and everything). I just wanted to make sure that people who planned on using this application as inspiration for a real-world application would be aware of this issue.

By taking advantage of the sessionid cookie given to users, any user is able to access any other user's information. This is because the application doesn't associate sessions with users.

An example of exploiting this:

1. Log into the application as [email protected]
2. Grab the sessionid cookie given by the server
3. Send a request to /rest/api/customer/byid/[email protected] with the cookie (e.g. curl localhost:9080/rest/api/customer/byid/[email protected] --cookie "sessionid=<your sessionid cookie>", or just visit the page in your browser if it has the cookie)

The same technique can be used to modify any arbitrary user as well.