Advertisement






FusionPBX Session Fixation

CVE Category Price Severity
CVE-2020-5758 CWE-384 Unknown High
Author Risk Exploitation Type Date
Kishan Lal Mohan Critical Remote 2024-03-30
CPE
cpe:/a:fusionproject:fusionpbx
CVSS EPSS EPSSP
CVSS:4.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H 0.15 17

CVSS vector description

Our sensors found this exploit at: https://cxsecurity.com/ascii/WLB-2024030076

Below is a copy:

FusionPBX Session Fixation
*Vulnerability Name - *Application is Vulnerable to Session Fixation

*Vulnerable URL: *www.fusionpbx.com


*Overview of the Vulnerability*
Session fixation is a security vulnerability that occurs when an attacker
sets or fixes a user's session identifier, manipulating the authentication
process. Typically exploited in web applications, this vulnerability allows
the attacker to force a user's session ID to a known value, granting
unauthorized access. Attackers can initiate the attack by tricking users
into using a provided session ID or by planting a session ID through
various means.


*Steps to Reproduce*
Step 1: To reproduce this vulnerability open two browsers. Copy "PHPSESSID"
cookie from Browser 1 and paste it to Browser 2.
Step 2: Login in Browser 1 using valid credentials.
Step 3: Navigate to Browser 2 and refresh the page or open this URL (
https://www.fusionpbx.com/app/account/home.php)
Step 4: Successfully logged in Browser 2 without entering the credentials.


*Impact of Vulnerability:*
Anyone can easily hijack victims or user's sessions and get into his account
. Cookie stealing is the best way the hacker can get into account.. it
would not take more than 5 min to steal someone's cookie using PHP and all
.....
Even friends can fool the victim and get him hacked...


*Mitigation:*Manage sessions properly. This problem is mainly faced because
the session doesn't get expired or doesn't get closed when logout is
pressed. Each time the user logins the cookie must hold a unique different
session-id to proceed.


------------------------------------------------------------------------------------------------------


*FusionPBX Development Team Implemented Fix GitHub Commit Links:*
https://github.com/fusionpbx/fusionpbx/commit/50220d7a0674fae944a1e16fab7a8517cdc51a9e
https://github.com/fusionpbx/fusionpbx/commit/560a51cff710df12c863de53c4c8289e1516dae8

Copyright ©2024 Exploitalert.

All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use.