Certified Ethical Hacker (CEH) Practice Question

Because the application does not regenerate the session identifier after authentication, an attacker can pre-set or capture the unauthenticated PHPSESSID value and then trick the victim into logging in while that same ID is already in place. Once the user authenticates, the attacker simply reuses the known session ID to access the account-this is the classic definition of session fixation. Reflected XSS could steal cookies, but the HttpOnly flag or the lack of an injection point would block that path. CSRF forces the victim's browser to act, but it does not reveal the session token to the attacker. Clickjacking can cause unintended clicks but likewise does not provide the attacker with the session identifier. Therefore, session fixation is the viable method here.