Executive brief
The Syllabus-Aligned Learning Management & Examination System is a web-based platform used for managing course syllabi and student assessments. A session fixation vulnerability in the login component allows an attacker to hijack user sessions and gain unauthorized access to student or instructor accounts without requiring valid credentials.
Technical details
The vulnerability is a session fixation flaw in the auth_process.php login component that fails to regenerate session identifiers after successful authentication. An attacker can force a victim to use a known session token, then leverage that same token to impersonate the victim after they log in. The attack is remotely accessible without authentication. Related issues include incomplete authorization checks, missing session destruction on logout, no session timeout enforcement, and missing secure cookie flags. No patch information is currently available for version 1.0.
Affected products
- SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0
Timeline
- 2026-09-07: disclosed: Publicly disclosed vulnerability report
- 2026-09-07: advisory: CVE-2026-86279 published