Description
All-Dynamics Software enlogic:show 2.0.2 contains a session fixation vulnerability that allows attackers to set a predefined PHP session identifier during the login process. Attackers can forge HTTP GET requests to welcome.php with a manipulated session token to bypass authentication and potentially execute cross-site request forgery attacks.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| All-Dynamics Software | enlogic:show Digital Signage System | 2.0.2 (Build 2098) ILP32W 0/1/3/1597919619 | — |
References
- Zero Science Lab Disclosure (ZSL-2020-5577) third-party-advisory
- Vendor Changelog for Version 2.0.3 product
- Packet Storm Security Exploit Entry exploit
- IBM X-Force Vulnerability Database Entry vdb-entry
- VulnCheck Advisory: All-Dynamics Software enlogic:show 2.0.2 Session Fixation Authentication Bypass third-party-advisory