| Título | SourceCodester Smart Attendance System with QR Code Scanner 1.0 Session Fixation |
|---|
| Descripción | Session fixation in SourceCodester Smart Attendance System with QR Code Scanner 1.0 allows an attacker who can plant a PHPSESSID cookie value in the victim's browser to obtain an authenticated administrator session after the victim logs in, without stealing any credential.
login.php starts the session (line 3) and populates $_SESSION['user_id'/'username'] on successful login (lines 17-18) but never calls session_regenerate_id() - the session identifier survives the privilege change unchanged. The session cookie additionally lacks the HttpOnly flag, easing the planting step (e.g. via the stored XSS via student name).
CWE-384. CVSS 3.1: AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N = 6.8.
Verified on a local deployment (PHP 7.3.4 / MySQL 5.7.26, 2026-10-17):
- Pre-login session id: poegdill95lkakekmedc4a8tuh (issued by GET /login.php)
- Admin login performed while presenting exactly that id
- GET /index.php with only that cookie -> 200 Dashboard ("TOTAL STUDENTS", "Real-time Activity Log")
- The identifier survived login unchanged and granted access.
Impact: full administrative account takeover without credential theft; defeats logout-based controls (the attacker holds the same id); enables silent persistence.
Remediation: call session_regenerate_id(true) on privilege change; enable session.use_strict_mode; set HttpOnly + SameSite=Strict + Secure on the session cookie; bind the session to a request fingerprint.
PoC:
curl -s -c pre.txt "http://<TARGET>/login.php" # PHPSESSID=<S>
# victim logs in with the planted cookie PHPSESSID=<S>
curl -s -b "PHPSESSID=<S>" "http://<TARGET>/index.php" # 200 - authenticated dashboard
White-box audit by EVA Security Research (yuechuya), 2026-10-17. Full 12-section report, source SHA-256 manifest and three-pass review:
https://github.com/yuechuya/sourcecodester-vuln-reports/blob/main/reports/VULN-06-Session-Fixation.md |
|---|
| Fuente | ⚠️ https://github.com/yuechuya/sourcecodester-vuln-reports/blob/main/reports/VULN-06-Session-Fixation.md |
|---|
| Usuario | yuechuya (UID 101209) |
|---|
| Sumisión | 2026-10-18 10:42 (hace 22 días) |
|---|
| Moderación | 2026-11-09 17:57 (22 days later) |
|---|
| Estado | Aceptado |
|---|
| Entrada de VulDB | 433183 [SourceCodester Smart Attendance System with QR Code Scanner 1.0 login.php autenticación débil] |
|---|
| Puntos | 20 |
|---|