You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository has been archived by the owner on Mar 2, 2019. It is now read-only.
We can see that even after we successfully logged in, the system does not regenerate a new session_id.
Note that this Session Fixation Vulnerability could easily be exploited with the help of any XSS Vulnerability in the same domain, eg. XSS Vulnerability in /readfile.php, as there is no Http-Only flag.
/loginc.php
We can see that even after we successfully logged in, the system does not regenerate a new session_id.
Note that this Session Fixation Vulnerability could easily be exploited with the help of any XSS Vulnerability in the same domain, eg. XSS Vulnerability in /readfile.php, as there is no Http-Only flag.
Once the victim logged in with the session cookie above, then the attacker could take full control of the victim's account using the same cookie.
The text was updated successfully, but these errors were encountered: