CVE-2024-57052

The vulnerability classified as CWE-384 (Session Fixation) consists of improper validation of the sessionID parameter passed to the index.php file. An attacker can manipulate the value of this parameter in a way that allows hijacking or fixing the session of a privileged user. Since the attack does not require authentication or victim interaction, it can be performed entirely remotely over the network.

Successful exploitation of the vulnerability allows an attacker to escalate privileges to a privileged user or administrator level, which may result in complete takeover of the application, disclosure of sensitive data, and modification or deletion of website content.

Apply patches available from the vendor according to references. Additionally, it is recommended to restrict access to the index.php file from external networks and implement mechanisms for monitoring suspicious requests containing unexpected sessionID parameter values.

YouDianCMS version 9.5.20 and all earlier versions.