Given the following conditions,
- Session ID does not change upon login
- Session ID travels in form of HTTP cookie
- There is no cross site scripting/redirection vulnerability on the login page
is it still possible to perform a session fixation attack?
Yes, the HTTP traffic is vulnerable to MITM attacks, either by direct packet modification or simply by routing the connection through an HTTP proxy or redirection via DNS poisoning.
one possible scenario
First, please read upon session fixation attacks and make sure you understand how they work. You didn't give us the information that is needed to determine whether standard session fixation attacks will work; all of that information is relevant to other attacks, but not to session fixation.
The fundamental characteristic of a session fixation attack is that the attacker manages to enroll the victim into a session that was previously established by the attacker. After this, the attacker has control of a session that is now being used by the victim as well, which may enable the attacker to do all sorts of bad things.
The primary precondition for a session fixation attack to be possible is the attacker has to be able to force the victim to start using a session ID of the attacker's choice. On some web sites, this is possible if the attacker can get the victim to visit a link like
So, you haven't given us enough information to know whether session fixation attacks will work, because you haven't given us enough information to determine whether the precondition is met.
That said, the site almost certainly has security problems. It is vulnerable to eavesdropping (Firesheep-like attacks) and likely vulnerable to login CSRF.