PluXml CMS Session Fixation Vulnerability Allowing Session Hijacking

A session fixation vulnerability has been identified in PluXml CMS versions 5.8.21 and 5.9.0-rc7. This vulnerability allows an attacker to set a session identifier for a user before authentication, with the session ID remaining unchanged after the user logs in. As a result, the attacker can hijack the authenticated session of the user. While only these two versions have been tested and confirmed vulnerable, other versions may also be affected.

Impact

Exploitation of this vulnerability allows for session hijacking, where an attacker can take over an authenticated user's session.