CVE-2016-4309

HIGH 7.5CVE-2016-4309 · Published 30/06/2016 · updated 17/06/2026

Package	Affected versions	Patched versions
symphony getsymphony	`= 2.6.7`	No fix yet

Description

Session fixation vulnerability in Symphony CMS 2.6.7, when session.use_only_cookies is disabled, allows remote attackers to hijack web sessions via the PHPSESSID parameter.

References

hyp3rlinx.altervista.org/advisories/SYMPHONY-CMS-SESSION-FIXATION.txt · Third Party Advisory
packetstormsecurity.com/files/137551/Symphony-CMS-2.6.7-Session-Fixation.html · Exploit
securityfocus.com/archive/1/538714/100/0/threaded · Third Party Advisory
securityfocus.com/bid/91299 · Third Party Advisory
symphonycms/symphony-2 commit b329a14 · Third Party Advisory
exploit-db.com/exploits/39983 · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free