CVE-2018-16239

CRITICAL

damicms 6.0.1 - Session Hijacking via Predictable Cookie Generation

Title source: llm
STIX 2.1

Description

An issue was discovered in damiCMS V6.0.1. It relies on the PHP time() function for cookies, which makes it possible to determine the cookie for an existing admin session via 10800 guesses.

References (1)

Core 1
Core References
Exploit, Third Party Advisory x_refsource_misc
https://github.com/howchen/howchen/issues/2

Scores

CVSS v3 9.8
EPSS 0.0123
EPSS Percentile 64.9%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-330
Status published
Products (1)
damicms/damicms 6.0.1
Published Aug 30, 2018
Tracked Since Feb 18, 2026