Description

A vulnerability was determined in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. The impacted element is an unknown function of the file auth_process.php of the component Login. This manipulation causes session fixiation. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-09-07T07:16:47.973Z",
  "pubdate": "2026-09-07T07:16:47.973Z",
  "executiveSummary": "The Syllabus-Aligned Learning Management & Examination System 1.0 is susceptible to a session fixation vulnerability located within the auth_process.php file.\nThis vulnerability allows an attacker to manipulate the authentication process, potentially hijacking a legitimate user's session.\nBy forcing or predicting a session identifier, an unauthorized actor can gain access to an authenticated session, leading to potential account takeover and unauthorized data access.\nThe vulnerability is remotely exploitable, posing a significant risk to the integrity and confidentiality of user sessions within the application.\nThe issue arises from a failure to properly regenerate or invalidate session identifiers upon successful authentication, allowing a pre-defined session ID to remain active after the user logs in.\nSince the exploit has been publicly disclosed, the risk of exploitation is elevated for systems that have not implemented compensating controls.",
  "technicalDetails": "The vulnerability resides in the authentication workflow handled by auth_process.php within the Syllabus-Aligned Learning Management & Examination System 1.0.\nThe root cause of the session fixation vulnerability is the application's failure to rotate or regenerate the PHP session identifier (session_id) upon a change in authentication state.\nIn a secure implementation, an application must call session_regenerate_id(true) immediately after verifying user credentials to ensure that any session ID existing prior to authentication is invalidated and replaced with a new, cryptographically secure identifier.\nIn the affected component, the system maintains the same session ID assigned to an anonymous visitor even after the user has successfully logged in, effectively fixing the session identifier throughout the transition from an unauthenticated to an authenticated state.\nThe attack flow typically proceeds as follows: 1. The attacker visits the login page to initiate a session, obtaining a valid session cookie from the server. 2. The attacker induces a target user to utilize this specific session identifier, often through social engineering, cross-site scripting (XSS), or by manipulating cookies if the application domain/path configurations are insufficiently restrictive. 3. The victim proceeds to authenticate using the attacker's supplied session identifier. 4. Because the auth_process.php script fails to regenerate the ID, the now-authenticated session remains associated with the attacker-controlled identifier. 5. The attacker, possessing the original session ID, uses it to authenticate their own browser, successfully gaining access to the victim’s account without knowing the victim's credentials.\nThis vulnerability does not require administrative privileges to initiate, and the lack of robust session management allows for remote exploitation across the network.\nPost-exploitation, the attacker assumes the identity of the victim, gaining access to all resources, examinations, and sensitive data associated with the victim's account within the LMS. This results in total loss of account integrity and potential unauthorized manipulation of examination results or educational data."
}