PDA

Bekijk Volledige Versie : Re: [MajorSecurity Advisory #54]xt:Commerce - Cross SiteScripting and Session Fixation Issues


admin@majorsecurity.de
22/09/08, 23:15
It's not the "PHPSESSID" parameter - instead it's the "XTCsid" parameter which is vulnerable to a session fixation attack.

Workaround:
================
Update to xt:Commerce 3.0.4 SP 2.1