SoftCOM iKSORIS Internet Starter Module Session Fixation Vulnerability

A session fixation vulnerability has been identified in the Internet Starter module of SoftCOM iKSORIS system, affecting all versions prior to 79.0. This vulnerability allows an attacker with access to a user's browser to set an arbitrary session cookie value. The attacker can then wait for the user to log in and use the same cookie to take over the user's account. Additionally, the system does not terminate old sessions when new ones are created, extending the window of opportunity for such an attack.

Impact

Exploitation of this vulnerability allows for unauthorized account access by hijacking a user's session.

Remediation

Users can update to SoftCOM iKSORIS version 79.0 or later to address this vulnerability.