{"id":"CVE-2026-121501","kind":"vulnerability","aliases":["CVE-2026-121501"],"related":[],"title":"CloudClassroom-PHP-Project: login page allows session fixation via PHPSESSID","description":"A vulnerability was determined in mathurvishal CloudClassroom-PHP-Project. The affected element is the function session_regenerate_id of the file loginlinkadmin.php. Executing a manipulation of the argument PHPSESSID can lead to session fixiation. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"A PHP course-management project's admin login script (loginlinkadmin.php) can be made to accept a session ID chosen by an attacker through the PHPSESSID argument. An attacker who gets a victim to log in with that session ID can then use the same session to act as the victim.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cloudclassroom-php-project","package","php","self-hosted","session-fixation"],"not_affected_if":["not-deployed","other-codebase"],"how_to_check":"Open loginlinkadmin.php in your deployment. The upstream master version calls session_start() and sets $_SESSION['umail'] after a successful login, with no session_regenerate_id() call. If yours matches, it is exposed. Also check php.ini: session.use_strict_mode=0 lets PHP accept a client-supplied session ID. Also check any other login scripts in the project (student, faculty) for the same pattern.","fix":null,"status":"open","published_at":"2026-11-03T19:18:04+00:00","first_seen_at":"2026-11-03T19:44:52+00:00","triaged_at":"2026-11-03T19:45:30+00:00","updated_at":"2026-11-03T19:46:37+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-03T19:45:30Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"CloudClassroom-PHP-Project: login page allows session fixation via PHPSESSID","impact":"high","summary":"A PHP course-management project's admin login script (loginlinkadmin.php) can be made to accept a session ID chosen by an attacker through the PHPSESSID argument. An attacker who gets a victim to log in with that session ID can then use the same session to act as the victim.","audience":"businesses","category":"package","nicknames":[],"who_cares":["php","cloudclassroom-php-project","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker hijacks an admin session after victim logs in","analyst_note":"Confirm the exact fix (none stated in sources; vendor did not respond) and whether admin sessions are fully taken over; check the NVD entry for the CVSS vector.","how_to_check":"- Look for `loginlinkadmin.php` in the deployed CloudClassroom-PHP-Project code and check whether it calls `session_regenerate_id` after login.\n- Check whether the app accepts `PHPSESSID` from URL parameters or cookies set by the client.","plain_action":"","needs_analyst":true,"not_affected_if":["not-deployed","other-codebase"],"who_is_affected":"Only installations of this specific PHP project that expose loginlinkadmin.php to the network are exposed. The sources say the product does not use versioning, so affected releases cannot be identified; any deployment of the project should be reviewed. unknown whether other products are affected.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00071,"input_tokens":4190,"output_tokens":582,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the exact fix (none stated in sources; vendor did not respond) and whether admin sessions are fully taken over; check the NVD entry for the CVSS vector.","search":"'-121501':14A,17A '-2026':13A,16A 'accept':45B 'act':77B 'admin':37B 'affect':92C,143C 'allow':7A 'argument':56B,109C 'attack':52B,58B,117C 'chosen':49B 'cloudclassroom':2A,19B,88C 'cloudclassroom-php-project':1A,18B,87C 'contact':152C 'cours':33B 'course-manag':32B 'cve':12A,15A 'determin':84C 'disclos':127C 'disclosur':156C 'earli':153C 'element':93C 'execut':104C 'exploit':123C 'file':102C 'fixat':9A,29B 'fixiat':115C 'function':96C 'get':60B 'host':26B 'id':48B,69B,99C 'inform':141C 'launch':120C 'lead':112C 'log':64B 'login':5A,38B 'loginlinkadmin.php':40B,103C 'made':43B 'manag':34B 'manipul':106C 'mathurvish':86C 'may':129C 'packag':22B 'page':6A 'php':3A,20B,23B,31B,89C 'phpsessid':11A,55B,110C 'product':133C 'project':4A,21B,35B,90C 'public':126C 'regener':98C 'releas':146C 'remot':121C 'respond':160C 'script':39B 'self':25B 'self-host':24B 'session':8A,28B,47B,68B,75B,97C,114C 'session-fix':27B 'unaffect':145C 'unavail':148C 'use':72B,136C 'util':131C 'vendor':150C 'version':137C 'via':10A 'victim':62B,80B 'vulner':82C 'way':163C","nicknames":[],"mitigations":[],"who_affected":"Anyone running the mathurvishal CloudClassroom-PHP-Project (a self-hosted PHP e-learning site) with the admin login loginlinkadmin.php reachable. The project has no versions, so no release can be named as affected or fixed; review any deployment. The attack needs the victim admin to log in using an attacker-supplied session ID (user interaction). Skip it if you do not run this project.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["cloudclassroomphpproject","high","package","php","selfhosted","sessionfixation"],"campaign_type":null,"first_public_at":"2026-11-03T19:18:04+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121501","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121501","severity":null,"published_at":"2026-11-03T19:18:04+00:00","modified_at":"2026-11-03T19:18:04+00:00","first_seen_at":"2026-11-03T19:44:52+00:00","fetched_at":"2026-11-03T19:44:52+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-121501:1524","url":null,"severity":null,"published_at":"2026-11-03T19:46:37+00:00","modified_at":"2026-11-03T19:46:37+00:00","first_seen_at":"2026-11-03T19:46:37+00:00","fetched_at":"2026-11-03T19:46:37+00:00","note":"NVD (VulDB CNA) lists CVSS 4.0 vector AV:N/PR:N/UI:P with low C/I/A impact, so it is not a full admin takeover by itself; the 7.5 on the signal is unconfirmed against the vector. The vendor did not respond and no fix exists. I read upstream loginlinkadmin.php on GitHub: no session_regenerate_id after login, which fits fixation. The same file has an unrelated SQL injection (CVE-2025-26198) that already gives admin access without fixation. Nothing marked verified, since there is no vendor advisory. No PoC link found."}],"documents":[{"id":60315,"url":"https://github.com/mathurvishal/CloudClassroom-PHP-Project/blob/master/loginlinkadmin.php","title":"loginlinkadmin.php (master) - CloudClassroom-PHP-Project","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":60316,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121501","title":"NVD CVE-2026-121501","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}