CVE-2008-3428 Session fixation vulnerability in phpFreeChat 1.1 allows remote authenticated users to hijack web sessions by setting the session_id parameter to match the victim's nickid parameter.
MediumCVSS 6.5
EPSS 1.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Session fixation vulnerability in phpFreeChat 1.1 allows remote authenticated users to hijack web sessions by setting the session_id parameter to match the victim's nickid parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| phpfreechat | = 1.0-beta | No fix listed |
| phpfreechat | = 1.0-beta10 | No fix listed |
| phpfreechat | = 1.0-beta11 | No fix listed |
| phpfreechat | = 1.0-beta2 | No fix listed |
| phpfreechat | = 1.0-beta3 | No fix listed |
| phpfreechat | = 1.0-beta4 | No fix listed |
| phpfreechat | = 1.0-beta5 | No fix listed |
| phpfreechat | = 1.0-beta6 | No fix listed |
| phpfreechat | = 1.0-beta7 | No fix listed |
| phpfreechat | = 1.0-beta8 | No fix listed |
| phpfreechat | = 1.0-beta9 | No fix listed |
| phpfreechat | = 1.0-final | No fix listed |
| phpfreechat | = 1.1 | No fix listed |
References
- 31283 third-party-advisory vendor-advisory
- www.phpfreechat.net patch
- 30462 patch vdb-entry
- phpfreechat-nickid-weak-security(44116) vdb-entry