Posted by Bruno Rafael Moreira de Barros on 09/28/59 12:00

> Could SID be manipulated to contain something nasty instead of
> "Name_of_session_id_variable=hexadecimal_session_id", so that it might
> warrant escaping?
>
> Sebastian

Not nasty things, but session stealing. If you are an ADMIN of the
website and your SSID is 55555, and you are on the website and see
something nice to tell me, a nobody in your website, you will send:

www.mysite.com/page.php?SID=55555

And I will be on the page with Administrator Permissions. Which is
awful. I myself use Cookies for SID, so the dumb users don't make
errors like what I've just told you about.

[Back to original message]