BLUEPAGE CMS 'PHPSESSID' Session Fixation Vulnerability

Bugtraq ID:	31315
Class:	Design Error
CVE:	CVE-2008-6039
Remote:	Yes
Local:	No
Published:	Sep 22 2008 12:00AM
Updated:	May 07 2015 05:23PM
Credit:	David Vieira-Kurz
Vulnerable:	Integrated Software Solutions BLUEPAGE CMS 2.5
Not Vulnerable:	Integrated Software Solutions BLUEPAGE CMS 2.5.8

BLUEPAGE CMS 'PHPSESSID' Session Fixation Vulnerability

BLUEPAGE CMS is prone to a session-fixation vulnerability.

Attackers can exploit this issue to hijack a user's session and gain unauthorized access to the affected application.

BLUEPAGE CMS 2.5 is vulnerable; other versions may also be affected.

BLUEPAGE CMS 'PHPSESSID' Session Fixation Vulnerability

An attacker can exploit this issue by enticing an unsuspecting victim into following a malicious URI.

The following example URI is available:

http://www.example.com/BluePageCMS/?PHPSESSID=15031988

BLUEPAGE CMS 'PHPSESSID' Session Fixation Vulnerability

Solution:
The vendor released an update. Please see the references for more information.

BLUEPAGE CMS 'PHPSESSID' Session Fixation Vulnerability

References:

• BLUEPAGE CMS Homepage (Integrated Software Solutions)
  
• [MajorSecurity Advisory #53]BLUEPAGE CMS - Cross Site Scripting ([email protected])
  
• Re: [MajorSecurity Advisory #53]BLUEPAGE CMS - Cross Site ([email protected])