Description

A security vulnerability has been detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The impacted element is the function Session::checkLogin of the file include/session.php of the component Session Handler. Such manipulation of the argument cookname/cookid leads to incorrect comparison. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-10-13T06:16:34.070Z",
  "pubdate": "2026-10-13T06:16:34.070Z",
  "executiveSummary": "A vulnerability has been identified in the Session::checkLogin function within the itsmeravitejak Online-Examination-System (up to commit e6208e630b14657999bbfe4c9912302d2a1e2449). The flaw stems from an incorrect comparison of the cookname or cookid parameters, which reside in include/session.php.\nThis vulnerability is categorized as an improper comparison issue, allowing remote, unauthenticated attackers to potentially bypass session validation mechanisms.\nThe risk implication is significant as it affects the authentication flow of the application, potentially permitting unauthorized access to the system by manipulating cookie-based session identifiers.\nThe vulnerability is remotely exploitable, requiring no prior authentication. As the project maintains a rolling release model and has not responded to vulnerability disclosures, users remain exposed without a direct upstream patch. Exploitation leverages the public disclosure of the flaw to facilitate unauthorized session state manipulation.",
  "technicalDetails": "The vulnerability exists in the component responsible for session validation, specifically within the Session::checkLogin function located at include/session.php. The root cause is a flaw in the logic used to evaluate the authenticity of session cookies, specifically the cookname and cookid parameters.\nUnder normal operating conditions, the checkLogin function is designed to verify the integrity of the user's session by comparing provided cookie data against stored session state or cryptographic expectations. The incorrect comparison logic fails to securely validate these inputs, allowing an attacker to supply manipulated cookie values that satisfy the faulty comparison condition.\nThe attack flow proceeds as follows: An attacker sends a crafted HTTP request containing malicious cookname or cookid values. Upon receipt, the include/session.php script invokes Session::checkLogin. The flawed comparison logic evaluates the input against the existing session criteria. Due to the loose comparison or improper handling of data types/values, the check returns a successful authentication result despite the lack of a valid session.\nBecause this check is central to the application's session management, successful exploitation enables the attacker to masquerade as an authenticated user. This post-exploitation impact allows for the unauthorized access to sensitive examination data, potential administrative function access, or any resources restricted by the session handler.\nThe vulnerability is reachable over a network without authentication. Because the application relies on these parameters to establish a session, the exploitation does not require advanced access levels, only the ability to craft and transmit the necessary HTTP headers. The lack of proper validation creates a bypass that essentially nullifies the existing authentication boundary, making the system susceptible to remote session hijacking or impersonation."
}