SourceCodester LMS EUVD-2026-72273

The attack requires the victim to authenticate to the LMS using an attacker-controlled session identifier, which means the attacker must first deliver a crafted login URL to the victim and persuade them to use it to log in (UI:P/UI:A - active user interaction is mandatory). The root condition is that auth_process.php does not call session_regenerate_id() on successful login, which is the default reported behavior of version 1.0. No attacker authentication or special privileges are required. Exploitation is limited to deployments of this specific SourceCodester PHP LMS; the product must be internet-accessible for a remote attacker to initiate the session and craft the link. Users on shared or publicly reachable LMS instances with predictable or URL-parameter-based session handling are most at risk.

The provided CVSS 4.0 score of 2.1 with VC:L/VI:L/VA:L materially understates real-world impact: successful session fixation yields a fully authenticated session, which in practice means C:H/I:H against the victim's account data and capabilities. The E:P modifier correctly acknowledges the publicly available PoC on GitHub. No CISA KEV entry exists and no EPSS data was provided; given the obscure product footprint, widespread automated exploitation is unlikely despite the network-accessible vector. The practical risk is substantially bounded by: the niche nature of the affected product, the requirement for user interaction (victim must authenticate using the planted session), and the social engineering prerequisite. Despite the misleadingly low CVSS score, any organization running this specific product should treat this as high priority due to session hijacking potential.

An attacker generates a valid pre-authentication session ID by loading the LMS login page, then crafts a login URL embedding that session token and sends it to a target user (via phishing email, for example). When the victim clicks the link and authenticates normally, auth_process.php accepts the login without regenerating the session ID - the attacker, who knows the original session token, immediately uses it to access the LMS as the authenticated victim. The GitHub PoC (VULN-06-Session-Management-Flaws.md) documents this technique against the auth_process.php endpoint.