Executive brief
PluXml CMS, a lightweight content management system, is vulnerable to a session hijacking flaw. An attacker can pre-set a user's session identifier before they log in, and because the system fails to refresh this identifier after authentication, the attacker can take full control of the victim's account. This could lead to unauthorized access to sensitive data, website defacement, or complete administrative takeover.
Technical details
A session fixation vulnerability (CWE-384) exists in PluXml CMS due to the application's failure to renew the session identifier upon successful user authentication. An attacker can supply a specific session ID to a victim's browser (e.g., via URL parameters or other injection methods); if the victim subsequently authenticates using that ID, the attacker can use the known identifier to hijack the established session. The vulnerability is confirmed in versions 5.8.21 and 5.9.0-rc7. The attack is network-reachable and requires no prior privileges, though it typically involves some level of user interaction to 'fix' the session ID in the victim's browser.
Affected products
- PluXml PluXml CMS 5.8.21, 5.9.0-rc7 (other versions may be affected)
Timeline
- 2026-02-27: advisory: NVD publication date