Posao.ba Session Hijacking
I must admit, if this site is Superbrand, we are all going to hell :-)
Ok, you are registered (unemployed perhaps) user of posao.ba (=job), searching through site you found awesome job ad!
Now you want to share it with your friends on Facebook! You click on well known button.
Your friends who think you're cool open up that link.
Now they are seeing "Welcome, Your Name!" and saying WT#, looks like I've gained access to his account, I'll change his password for fun :devil:
Next thing you know, you are being hacked, and it's really not your fault.
You can see "user" parameters with session id passing through GET variables, someone decided that using cookies is bad idea, but didn't know that sharing this link is even worse.
Posao.ba hire yourself good programmers, at least you know where to look at.
