CVE-2020-36913: enlogic:show Auth Bypass Vulnerability

CVE-2020-36913 Overview

CVE-2020-36913 is a session fixation vulnerability discovered in All-Dynamics Software enlogic:show version 2.0.2. This vulnerability allows attackers to set a predefined PHP session identifier during the login process, enabling authentication bypass and potential cross-site request forgery (CSRF) attacks. By forging HTTP GET requests to welcome.php with a manipulated session token, threat actors can hijack user sessions and gain unauthorized access to the application.

Critical Impact

Attackers can bypass authentication mechanisms by manipulating PHP session identifiers, potentially leading to complete account takeover and unauthorized access to sensitive application functionality.

Affected Products

• All-Dynamics Software enlogic:show 2.0.2
• Earlier versions of enlogic:show may also be affected

Discovery Timeline

• January 6, 2026 - CVE-2020-36913 published to NVD
• January 8, 2026 - Last updated in NVD database

Technical Details for CVE-2020-36913

Vulnerability Analysis

This session fixation vulnerability (CWE-384) exists in the authentication workflow of All-Dynamics Software enlogic:show 2.0.2. The application fails to properly regenerate session identifiers after successful authentication, allowing an attacker to fixate a session ID prior to the victim logging in. Once the victim authenticates using the attacker-controlled session, the attacker gains full access to the authenticated session.

The vulnerability is exploitable over the network and requires some user interaction, as the victim must click on a malicious link or visit a crafted page containing the fixed session token. The attack does not require any prior authentication or privileges in the target application.

Root Cause

The root cause of this vulnerability is the failure to regenerate the PHP session identifier upon successful user authentication. When a user logs in, the application should invalidate the existing session and create a new session ID to prevent session fixation attacks. Instead, enlogic:show 2.0.2 continues using the same session identifier that was established before authentication, allowing attackers to predict or set the session ID in advance.

Attack Vector

The attack exploits the welcome.php endpoint by injecting a predetermined session identifier via HTTP GET request parameters. The attack sequence typically follows this pattern:

1. The attacker generates a valid PHP session identifier
2. The attacker crafts a malicious URL containing the fixed session ID targeting the victim application
3. The victim is lured into clicking the malicious link (via phishing, social engineering, or embedded in a malicious page)
4. The victim authenticates to the application using the attacker-controlled session
5. The attacker uses the same session ID to hijack the authenticated session

This vulnerability can be chained with cross-site request forgery (CSRF) attacks to perform unauthorized actions on behalf of the victim user.

Detection Methods for CVE-2020-36913

Indicators of Compromise

• Suspicious HTTP GET requests to welcome.php containing session identifiers in URL parameters
• Multiple authentication attempts from different IP addresses using the same session ID
• Session tokens appearing in referrer logs or web server access logs
• Unusual session patterns where the same session ID is used before and after authentication

Detection Strategies

• Monitor web application logs for session ID parameters passed via URL query strings to authentication endpoints
• Implement web application firewall (WAF) rules to detect and block session tokens in GET request parameters
• Deploy anomaly detection to identify sessions originating from multiple geographic locations
• Review authentication logs for patterns indicating session fixation attempts

Monitoring Recommendations

• Enable detailed logging for the welcome.php endpoint and all authentication-related pages
• Configure alerts for session IDs that remain unchanged across login events
• Monitor for referrer headers containing session tokens which may indicate information leakage
• Implement session monitoring to detect concurrent usage of the same session from different sources

How to Mitigate CVE-2020-36913

Immediate Actions Required

• Upgrade to a patched version of enlogic:show if available (check the Enlogic Show Changelog for updates)
• Implement session regeneration upon successful authentication at the application level
• Restrict session ID transmission to cookies only with session.use_only_cookies enabled
• Review and harden session configuration in PHP settings

Patch Information

Administrators should consult the official Enlogic Show Changelog for information about available security updates. Additional technical details about this vulnerability are available from Zero Science Lab and IBM X-Force.

Workarounds

• Configure PHP to use cookies exclusively for session management by setting session.use_only_cookies = 1 in php.ini
• Enable session.use_strict_mode = 1 to reject uninitialized session IDs
• Implement a custom session handler that regenerates session IDs after authentication using session_regenerate_id(true)
• Deploy a reverse proxy or WAF to strip session identifiers from URL parameters before they reach the application

# PHP configuration hardening for session security
# Add to php.ini or .htaccess

php_value session.use_only_cookies 1
php_value session.use_strict_mode 1
php_value session.cookie_httponly 1
php_value session.cookie_secure 1
php_value session.cookie_samesite Strict