credit Al-mamon rasool abdali hussain # Exploit Title: OVH data center control panel session fixation vulnerability # Exploit Author: Al-mamon rasool abdali hussain # Vendor Homepage: ovh.com # Tested on: https://ca.ovh.com the well khnown french data center its users control panel suffer from session fixation vulnerability the cp of ovh send the uniq session through url like these https://ca.ovh.com/manager/index.html?csid=2xo38 the session parameter is csid while its small char size its easy to be brute forced also the cp will log you out after 1 min if you just open the url to stay connected and not been kiked out just go ro biling and try click all its item the session will be re-auth you and you gain full access now