Executive brief
Student-Management-System is a school administration tool that manages student grades, teacher records, and academic data. A vulnerability in its login and dashboard pages fails to set the HttpOnly flag on session cookies, allowing attackers with JavaScript access (via XSS) to steal session IDs and impersonate users. This could lead to unauthorized access to student records, grade modifications, and administrative functions.
Technical details
The vulnerability is a cookie security configuration defect: the application calls session_start() in login flows (admin_login.php, student_login.php, teacher_login.php) and dashboard pages without configuring the session.cookie_httponly setting or using session_set_cookie_params() to set httponly=true. This results in PHPSESSID cookies issued without the HttpOnly flag, making them readable by JavaScript. While not directly exploitable over the network, when combined with XSS vulnerabilities (such as the existing stored XSS in issue #3), an attacker can steal the session cookie via document.cookie and perform session hijacking. No patch has been released; the project operates on rolling releases and has not responded to the disclosure.
Affected products
- sambitraj Student-Management-System up to commit 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5
Timeline
- 2026-07-17: disclosed: Vulnerability reported on GitHub issue #10
- 2026-08-31: advisory: Published to NVD as CVE-2026-82697