| 제목 | SourceCodester Smart Attendance System with QR Code Scanner 1.0 Session Fixation |
|---|
| 설명 | Session fixation in SourceCodester Smart Attendance System with QR Code Scanner 1.0 allows an attacker who can plant a PHPSESSID cookie value in the victim's browser to obtain an authenticated administrator session after the victim logs in, without stealing any credential.
login.php starts the session (line 3) and populates $_SESSION['user_id'/'username'] on successful login (lines 17-18) but never calls session_regenerate_id() - the session identifier survives the privilege change unchanged. The session cookie additionally lacks the HttpOnly flag, easing the planting step (e.g. via the stored XSS via student name).
CWE-384. CVSS 3.1: AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N = 6.8.
Verified on a local deployment (PHP 7.3.4 / MySQL 5.7.26, 2026-10-17):
- Pre-login session id: poegdill95lkakekmedc4a8tuh (issued by GET /login.php)
- Admin login performed while presenting exactly that id
- GET /index.php with only that cookie -> 200 Dashboard ("TOTAL STUDENTS", "Real-time Activity Log")
- The identifier survived login unchanged and granted access.
Impact: full administrative account takeover without credential theft; defeats logout-based controls (the attacker holds the same id); enables silent persistence.
Remediation: call session_regenerate_id(true) on privilege change; enable session.use_strict_mode; set HttpOnly + SameSite=Strict + Secure on the session cookie; bind the session to a request fingerprint.
PoC:
curl -s -c pre.txt "http://<TARGET>/login.php" # PHPSESSID=<S>
# victim logs in with the planted cookie PHPSESSID=<S>
curl -s -b "PHPSESSID=<S>" "http://<TARGET>/index.php" # 200 - authenticated dashboard
White-box audit by EVA Security Research (yuechuya), 2026-10-17. Full 12-section report, source SHA-256 manifest and three-pass review:
https://github.com/yuechuya/sourcecodester-vuln-reports/blob/main/reports/VULN-06-Session-Fixation.md |
|---|
| 원천 | ⚠️ https://github.com/yuechuya/sourcecodester-vuln-reports/blob/main/reports/VULN-06-Session-Fixation.md |
|---|
| 사용자 | yuechuya (UID 101209) |
|---|
| 제출 | 2026. 10. 18. AM 10:42 (22 날 ago) |
|---|
| 모더레이션 | 2026. 11. 09. PM 05:57 (22 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 433183 [SourceCodester Smart Attendance System with QR Code Scanner 1.0 login.php 약한 인증] |
|---|
| 포인트들 | 20 |
|---|