CloudClassroom-PHP-Project CVE-2026-121501

Exploitation requires the attacker to fix or supply a PHPSESSID value and then have a legitimate user complete authentication through loginlinkadmin.php, because the code fails to regenerate the session identifier at login (session fixation); the CVSS UI:P/UI:R dependency means a victim login is mandatory and the attack cannot succeed without that interaction. Reachability is remote and unauthenticated for the attacker (PR:N), but impact is limited to session takeover with Low confidentiality and integrity effect and no scope change. Limiting factors: required user interaction (victim must log in under the attacker-influenced session), and the obscure, unversioned deployment base. No fixed version exists - the vendor did not respond to the disclosure, so no vendor patch or official mitigation is available.

This is a low-priority issue that scores as genuinely low risk across every available signal, not a high-CVSS-but-overrated case. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) yields a base score of only 2.1, reflecting unauthenticated network reachability but required user interaction and only Low confidentiality/integrity/availability impact on the vulnerable system with no scope change. The vuln.today decision label is 'monitor', the weakest urgency tier, consistent with the low score. There is no CISA KEV listing, so this is NOT confirmed actively exploited, and no EPSS probability was supplied in the input, so widespread-exploitation likelihood cannot be quantified here. A public PoC reference exists (a GitHub advisory) but it is not verified as working exploit code, so exploit maturity is weak (vector carries E:P, proof-of-concept). The session fixation flaw (CWE-384) requires a victim to authenticate using an attacker-supplied PHPSESSID, so exploitation hinges on tricking a user rather than a direct server compromise. Net: a real but minor weakness in an obscure product - appropriate to track and patch opportunistically, not an emergency.

An attacker crafts a link or request that plants a known PHPSESSID value for the CloudClassroom-PHP-Project admin login flow, then lures a victim (e.g., an administrator) into authenticating within that session; because loginlinkadmin.php does not regenerate the session identifier on login, the attacker reuses the now-authenticated PHPSESSID to hijack the session. A public PoC reference exists (GitHub advisory) but it is not verified as working exploit code, and the attack depends on the victim performing the login (UI:P/UI:R).