medium6.8Public exploit code
CVE-2013-7387
Session fixation vulnerability in DataLife Engine (DLE) 9.7 and earlier allows remote attackers to hijack web sessions via the PHPSESSID cookie.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- DataLife Engine - 'preview.php' PHP Code Injection (Metasploit)2013-02-01 · remote · php · Verified
- DataLife Engine 9.7 - 'preview.php' PHP Code Injection2013-01-28 · webapps · php · Verified
Impact
Session fixation vulnerability in DataLife Engine (DLE) 9.7 and earlier allows remote attackers to hijack web sessions via the PHPSESSID cookie.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Dleviet | Datalife Engine | through 9.7 |
References
- NVD record
- CVE.org record
- http://dle-news.ru/bags/v97/1549-patchi-bezopasnosti-dlya-versii-97.html
- http://en.securitylab.ru/lab/PT-2012-53
- http://secunia.com/advisories/51971
- http://dle-news.ru/bags/v97/1549-patchi-bezopasnosti-dlya-versii-97.html
- http://en.securitylab.ru/lab/PT-2012-53
- http://secunia.com/advisories/51971