Code injection

PicturesPro Photo Cart 6 and 7 before Security-Patch-2018-B allows remote attackers to access arbitrary customer accounts via a modified cookie, related to pchead.php, pclogin.php, and pcloginpage.php...