OpenCart Session Fixation Vulnerability in OCSESSID Cookie

A session fixation vulnerability has been identified in OpenCart version 3.0.3.8. This vulnerability allows attackers to hijack user sessions by injecting arbitrary values into the OCSESSID cookie. The server accepts and maintains these malicious cookie values, enabling session takeover and unauthorized access to user accounts.

Impact

Exploitation of this vulnerability allows for session hijacking, enabling attackers to take over user accounts.

Reproduction

To reproduce this vulnerability, set a custom value for the OCSESSID cookie. The server will accept this value, allowing for session fixation. This can be done using a web browser or a tool that modifies cookie values before sending a request to the server.