Session Hijacking Vulnerability in SoftCOM iKSORIS Internet Starter Module
A session hijacking vulnerability exists in SoftCOM iKSORIS system's Internet Starter module. An attacker with access to a user's browser can set an arbitrary session cookie and wait for the user to log in. Once the user authenticates, the attacker can use the same cookie to take over the user's account. The vulnerability is further complicated by the system's failure to destroy old sessions when creating new ones, which increases the potential attack window. This security issue has been addressed and patched in version 79.0 of the software.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
softcom iksoris |
Vulmon