Executive brief
The College-Management-System is a web application for managing student and lecturer accounts at universities. An attacker can hijack an authenticated user's session by forcing the victim to log in with a session identifier known to the attacker, then reusing that identifier to impersonate the victim and access their protected profile information including grades, personal data, and academic records.
Technical details
The vulnerability is a session fixation flaw in the authentication component (Front-end/server.php) where session_start() is called before credential verification and the session identifier is never regenerated after successful login. An attacker can cause a victim to authenticate using an attacker-supplied session ID through same-site cookie-setting or similar techniques; if successful, the attacker can reuse the same PHPSESSID to access the victim's authenticated session without needing the password.
Affected products
- Mstfakts College-Management-System
Timeline
- 2026-07-20: disclosed: Vulnerability reported on GitHub issue #8
- 2026-09-22: disclosed: CVE-2026-95828 published