username and Password sent as clear text strings

[jfvanmeter () comcast net]

Hello everyone, and I know this might not be the most correct place to post this questions, but I was hoping to get 
some feedback on what you think the potential risk would be and how this this could be exploited.

I completed a security review of a web server, that creates a SSL connection between the cleint and the server. Using 
WebScarab, I could see that the username and password are sent as clear text strings. The log in to the server requires 
a administrative account.

Do you think there is a large amount of risk, in sending the username and password as a clear text string, since the 
pipe is encrypted? I was thinking that a man-in-the-middle or sometype of session hijacking attack  could allow the 
account to be compromised.

 I'm working on completing the report for my client and was hoping to get some feedback from everyone so I could pose 
this to them correcly.

Thank you in advance --John 

------------------------------------------------------------------------
This list is sponsored by: Cenzic

Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!

http://www.cenzic.com/downloads
------------------------------------------------------------------------