Executive brief
A security flaw exists in the CollegeManagementSystem, a platform used to manage student records, staff, and academic data. An attacker can trick a user into using a specific session ID, allowing the attacker to hijack the user's account once they log in. This could lead to unauthorized access to sensitive student information or administrative functions without the attacker needing to know the user's password.
Technical details
A session fixation vulnerability exists in the login-form.php component of the CollegeManagementSystem. The application calls session_start() but fails to invoke session_regenerate_id(true) after a successful authentication event. This allows a remote attacker to pre-determine a session identifier (PHPSESSID), force a victim to use it, and then inherit the authenticated session once the victim logs in. Successful exploitation grants the attacker full access to the victim's account, including administrative privileges if the victim is an admin. As of the advisory date, no patch has been released by the vendor.
Affected products
- tittuvarghese CollegeManagementSystem 3e476335cfbfb9a049e09f474c7ec885f69a9df3
Timeline
- 2026-05-18: disclosed: Issue reported on GitHub repository
- 2026-06-05: advisory: CVE published via VulDB/NVD