![Re: [MajorSecurity Advisory #54]xt:Commerce - Cross SiteScripting and Session Fixation Issues](https://www.webhostingtalk.nl/images/WHT_rd/misc/dT.png)
It's not the "PHPSESSID" parameter - instead it's the "XTCsid" parameter which is vulnerable to a session fixation attack.
Workaround:
================
Update to xt:Commerce 3.0.4 SP 2.1
Likes: 0
It's not the "PHPSESSID" parameter - instead it's the "XTCsid" parameter which is vulnerable to a session fixation attack.
Workaround:
================
Update to xt:Commerce 3.0.4 SP 2.1
Quote