I received a PCI vulnerability on my most recent scan that I had not seen before. I have manually confirmed the vulnerability is present.

I have v1.5.7c running on PHP 7.3.20. Here's how it works:

If I access my shop with the following URL: "https://shop.example.com/?zenid=0123456789abcdef0123456789abcdef" a new session is created using the supplied id. (Note that we actually use a custom session name rather than "zenid".) This can be confirmed by checking the session cookie in the developer tools. A bad actor could use a possible phishing method to hijack a user's session. I have also confirmed the behavior in an older shop that we have running v1.5.0.

I have traced this behavior to line 65 in /init_includes/init_sessions.php, which is "zen_session_id($_GET[zen_session_name()]);". A quick fix would be to disable this line (and the conditional before it) so that session id's are never set from GET but only from POST. What I want to know is what side effects would this have for my shop?

Our PCI scanning provider, Sysnet Global Solutions, considers this a high risk vulnerability. I can't mark it as a false positive since I can reproduce it myself. Any help would be greatly appreciated.

Thanks.