EasyCTF before 1.4 does not validate the session ID, which allows remote attackers to obtain access via a crafted HTTP request.

Published May 1, 2015 · Updated Aug 6, 2024 · Assigned by jpcert