playSMS through 1.4.3 is vulnerable to session fixation.
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
Link | Tags |
---|---|
https://github.com/antonraharja/playSMS/issues/605 | issue tracking exploit third party advisory |