Key Information Summary Vulnerability Type Session Fixation Vulnerability (CVE-384) Affected Versions 1.0.6.1 Vulnerability Description A critical session fixation vulnerability exists in both user and admin login functionalities. After a successful login, the application fails to generate a new session ID. Attackers can reuse a legitimate pre-authenticated PHPSESSID or invent an arbitrary string as PHPSESSID to hijack user sessions. Vulnerable Code Locations 1. Admin Login - File: - Method: 2. Regular User Login - File: - Method: Reproduction Steps 1. On the attacker’s machine, choose an arbitrary string, such as . 2. On the victim’s machine, use browser developer tools to set the PHPSESSID cookie to . 3. The victim logs in as an admin; the method executes, associating the admin’s session with the attacker’s cookie. 4. On the attacker’s machine, set the PHPSESSID cookie to and navigate to the admin dashboard. The attacker gains full access. Recommended Mitigation The methods in both files must immediately regenerate the session ID after setting session data, using the native PHP function . Fix Recommendation Patch the methods in and by adding . Status Fixed and closed