| शीर्षक | ningzichun student-management-system 98760f5711cf6dc8b4adca53a9e207ca49b02ebf Session Fixiation |
|---|
| विवरण | The affected component is `login.php`. The handler calls `session_start()` at line 2 and assigns authenticated user or administrator state at lines 16-24, but never calls `session_regenerate_id()` after successful authentication. On PHP deployments that accept attacker-supplied session IDs (`session.use_strict_mode=0`, the tested PHP 7.4 default), a user can authenticate under a session identifier chosen in advance by an attacker. The attacker can then reuse that identifier to access the resulting authenticated session. |
|---|
| स्रोत | ⚠️ https://github.com/ningzichun/student-management-system/issues/16 |
|---|
| उपयोगकर्ता | Din0s4ur (UID 77596) |
|---|
| सबमिशन | 29/07/2026 08:08 PM (1 महीना पहले) |
|---|
| संयम | 08/09/2026 11:36 AM (1 month later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 399763 [ningzichun Student Management System तक 98760f5711cf6dc8b4adca53a9e207ca49b02ebf login.php session_start कमजोर प्रमाणीकरण] |
|---|
| अंक | 20 |
|---|