PT-2021-20132 · Cubecart · Cubecart

Abrookbanks · Published 2021-05-27 · Updated 2021-06-02 · CVE-2021-33394

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cubecart version 6.4.2

Description The issue allows for Session Fixation, where the application fails to generate a new session cookie after a user logs in. This enables a malicious user to create and inject a new session cookie value into a victim's session. Once the victim logs in, the injected cookie becomes valid, granting the attacker access to the user's account through the active session.

Recommendations For Cubecart version 6.4.2, consider implementing a mechanism to regenerate a new session cookie after a user logs in to prevent session fixation attacks. As a temporary workaround, restrict access to sensitive user account information until a proper fix is applied.

Exploit

Fix

Session Fixation

Weakness Enumeration

CWE-384

Related Identifiers

CVE-2021-33394

Affected Products

Cubecart

References · 4

• 🔥 https://github.com/xoffense/POC/blob/main/Session%20Fixation%20in%20Cubecart%206.4.2.md · Exploit
• https://github.com/cubecart/v6/commit/aac7b3a13a43e302d91f94a120417b2fda737d0f · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-33394 · Security Note
• https://osv.dev/vulnerability/CVE-2021-33394 · Vendor Advisory