Simple Machines Forum 1.1.11 Session Fixation

`========================================================================================   
| # Title : Simple Machines Forum 1.1.11 Mullti Vulnerability   
| # Author : indoushka   
| # email : [email protected]   
| # Home : www.sec-war.com   
| # Web Site : http://www.simplemachines.org/   
| # Dork : Powered by SMF 1.1.11 | SMF © 2006-2009, Simple Machines LLC   
| # Tested on: windows SP2 Français V.(Pnx2 2.0) + Lunix Français v.(9.4 Ubuntu)   
| # Bug : Mullti   
====================== Exploit By indoushka =================================  
# Exploit :   
  
1- Mail List information :   
  
After Register go to : http://127.0.0.1/smf/index.php?action=mlist  
  
2- PHPSESSID session fixation:  
Vulnerability description  
This script is vulnerable to PHPSESSID session fixation attacks.  
  
By injecting a custom PHPSESSID is possible to alter the PHP session cookie. Attackers will normally manipulate cookie values to fraudulently authenticate themselves on a web site.  
This vulnerability affects /smf.   
The impact of this vulnerability  
By exploiting this vulnerability, an attacker may conduct a session fixation attack. In a session fixation attack, the attacker fixes the user's session ID before the user even logs into the target server, thereby eliminating the need to obtain the user's session ID afterwards.  
  
Attack details :  
  
GET /smf/?PHPSESSID=smfssionfixation   
  
How to fix this vulnerability  
Set session.use_only_cookies = 1 from php.ini. This option enables administrators to make their users invulnerable to attacks which involve passing session ids in URLs; defaults to 0.  
  
Web references :  
  
http://www.acros.si/papers/session_fixation.pdf  
  
http://www.php.net/session  
  
http://www.owasp.org/index.php/PHP_Top_5   
  
  
Dz-Ghost Team ===== Saoucha * Star08 * Redda * Silitoad * n2n ==========================================  
Not : Please I need financial assistance in order I make a tax to the   
state treasury before the ruling, final and unconditional access   
my release by mail and transportation Algerian approximately 500 U.S. dollars  
ccp:0013791941 Salah Eddine Nekaa  
--------------------------------------------------------------------------------------------------------  
`