Session stealing

[claudia]

hello everyone!

i have a question, i now use OSCommerce for a couple of days, now my question is if i send someone the whole url of the site i am on, for example: product_info.php?products_id=25&osCsid=b53c99e 8ab941c4bf87b0997ac19e885

what if that guys logs in with my account, isn't that a security risk?

sorry my question might be a bit stupid

x0x0x
claudia

[michael_s]

Not stupid. It is a small risk but they would still have to login and to do that they need your username and password to get access to your account, and if the session has already expired there is no risk at all.

But, it would be better to delete the session from the link...