CVE-2008-2970 Multiple session fixation vulnerabilities in Academic Web Tools (AWT YEKTA) 1.4.3.1, and 1.4.2.8 and earlier, allow remote attackers to hijack web sessions by setting the PHPSESSID parameter to (1) in...
HighCVSS 7.5
EPSS 2.4%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Multiple session fixation vulnerabilities in Academic Web Tools (AWT YEKTA) 1.4.3.1, and 1.4.2.8 and earlier, allow remote attackers to hijack web sessions by setting the PHPSESSID parameter to (1) index.php and (2) login.php in homepg/.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| yektaweb academic web tools | <= 1.4.2.8 | No fix listed |
| yektaweb academic web tools | <= 1.4.3.1 | No fix listed |
References
- 3959 third-party-advisory
- www.bugreport.ir
- 20080619 Academic Web Tools CMS <= 1.4.2.8 Multiple Vulnerabilities mailing-list
- 29813 vdb-entry
- academicwebtools-index-session-hijacking(43179) vdb-entry