mathurvishal CloudClassroom-PHP-Project loginlinkadmin.php session_regenerate_id PHPSESSID session fixiation

Summaryinfo

A vulnerability was found in mathurvishal CloudClassroom-PHP-Project. It has been rated as critical. The impacted element is the function session_regenerate_id of the file loginlinkadmin.php. The manipulation of the argument PHPSESSID leads to session fixiation. This vulnerability is listed as CVE-2026-121501. The attack may be initiated remotely. In addition, an exploit is available. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The vendor was contacted early about this disclosure but did not respond in any way.

Detailsinfo

A vulnerability, which was classified as critical, has been found in mathurvishal CloudClassroom-PHP-Project. This issue affects the function session_regenerate_id of the file loginlinkadmin.php. The manipulation of the argument PHPSESSID with an unknown input leads to a session fixiation vulnerability. Using CWE to declare the problem leads to CWE-384. Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions. Impacted is confidentiality, integrity, and availability.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-121501. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details as well as a public exploit are known.

The exploit is available at github.com. It is declared as proof-of-concept. The vendor was contacted early about this disclosure but did not respond in any way. By approaching the search of inurl:loginlinkadmin.php it is possible to find vulnerable targets with Google Hacking.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Project Management Software

Vendor

• mathurvishal

Name

• CloudClassroom-PHP-Project

Version

• 5dadec098bfbbf3300d60c3494db3fb95b66e7be
• c46ce5736007d9d6e51a8feeb9250729fe85f139
• dae0c5961a35a4faf28cde9e02117538f09f81c1

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #1019357: https://github.com/mathurvishal/CloudClassroom-PHP-Project CloudClassroom-PHP-Project 5dadec098bfbbf3300d60c3494db3fb95b66e7be Session Fixation (by rmsbpro)

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion