EIP-2026-110273

This exploit demonstrates a session fixation/injection vulnerability in OpenCart 3.0.3.8. The attacker can set an arbitrary value for the 'OCSESSID' cookie, which the server accepts without validation, leading to potential session hijacking.