Privilege escalation via replayed administrator session cookie

Improper access control in code-projects Simple Car Rental System 1.0 allows remote authenticated users to perform administrator operations. The application accepts a captured administrator cookie in place of a low-privilege session cookie, authorizing requests as the administrator without binding the session to that user. A valid low-privilege login and an administrator session cookie are required; the demonstrated consequence is unauthorized deletion of user messages.