Bugtraq mailing list archives
OSCommerce Session Fixation Vulnerability
From: laurent.desaulniers () gmail com
Date: 1 Apr 2009 23:35:34 -0000
There is a flaw in the way OSCommerce handles sessions. When a client visits a OSCommerce web page, the server sends a cookie. That cookie will be the session cookie for every further requests. Thus, once logged in, the cookie will be used to authenticate the user. When logging in (without cookies), the URL will look something like http://myserver/myapp/index.php?oscid=sometext An attacker can send a link crafted like that http://myserver/myapp/index.php?oscid=arbitrarysession. If the admin/user follows the link and logs in, his cookie will still be arbitrarysession. Thus, the attacker can hijack the session because he set the cookie. P.S. Thanks to the whole TeaM Random (www.etsmtl.ca) for this bug.
Current thread:
- OSCommerce Session Fixation Vulnerability laurent . desaulniers (Apr 02)
- <Possible follow-ups>
- Re: OSCommerce Session Fixation Vulnerability tech107 (Apr 14)