PlaySMS is vulnerable to Session fixation ( all versions, including the latest ). Due to the lack of randomization of the sessionID and reuse of sessionID (prior login, after login). An attacker can set the user's session and can take control of the user's account.

Steps to reproduce:

1. Login to PlaySMS ( Note down the value of cookie [ PHPSESSID ] ).
2. Logout.
3. You can confirm the same session by checking prior login and after logging in.
4. You can observe that the value of PHPSESSID will be the same as in Step 1