| शीर्षक | sambitraj STUDENT-MANAGEMENT-SYSTEM 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5 Cookie Without 'HttpOnly' Flag |
|---|
| विवरण | The affected components are the PHP login and dashboard pages that start sessions without configuring secure cookie attributes. The login pages call `session_start()` and issue a PHP session cookie:
```php
session_start();
...
$_SESSION['name'] = $row['name'];
$_SESSION['email'] = $row['email'];
```
Runtime responses set `PHPSESSID` without `HttpOnly`:
```http
Set-Cookie: PHPSESSID=0klqsok4qjcgftt0b2iivhtrkj; path=/
```
Because the cookie is readable from JavaScript, any XSS in the application can read and exfiltrate the session identifier. This increases the impact of the existing stored XSS issue by allowing direct session theft. |
|---|
| स्रोत | ⚠️ https://github.com/sambitraj/STUDENT-MANAGEMENT-SYSTEM/issues/10 |
|---|
| उपयोगकर्ता | gscsd (UID 97914) |
|---|
| सबमिशन | 17/07/2026 07:26 PM (1 महीना पहले) |
|---|
| संयम | 30/08/2026 07:56 PM (1 month later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 397185 [sambitraj Student-Management-System तक 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5 session_start अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|