{"id":"CVE-2026-125078","kind":"vulnerability","aliases":["CVE-2026-125078"],"related":[],"title":"SourceCodester Smart Attendance System: login.php session fixation lets attackers hijack sessions","description":"A security flaw has been discovered in SourceCodester Smart Attendance System with QR Code Scanner 1.0. This affects an unknown part of the file login.php. The manipulation results in session fixiation. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.","summary":"SourceCodester Smart Attendance System with QR Code Scanner 1.0 has a session fixation flaw (CWE-384) in login.php: the session ID is not renewed at login, so an attacker who plants a known session ID in a victim's browser can reuse it after the victim logs in. VulDB reports a public proof of concept; no exploitation in the wild is reported.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Smart Attendance System with QR Code Scanner","fixed":[],"affected":"1.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["other","php","self-hosted","smart-attendance-system"],"not_affected_if":["not-deployed"],"how_to_check":"Only version 1.0 is reported. Check whether the app is deployed: look for SourceCodester Smart Attendance System with QR Code Scanner in your web root. To test, note the PHPSESSID cookie before login at login.php; if the same value is still valid after login, the session is not rotated and the app is exposed.","fix":"No fixed version or vendor patch known as of 2026-11-10 (VulDB: no countermeasure known; suggests replacing the product). A code-level workaround is to call session_regenerate_id(true) after successful login in login.php.","status":"open","published_at":"2026-11-10T00:17:06+00:00","first_seen_at":"2026-11-10T00:28:41+00:00","triaged_at":"2026-11-10T00:30:05+00:00","updated_at":"2026-11-10T00:32:36+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-10T00:30:05Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"SourceCodester Smart Attendance System: login.php session fixation lets attackers hijack sessions","impact":"high","summary":"SourceCodester Smart Attendance System with QR Code Scanner 1.0 has a session fixation flaw in login.php. A remote attacker can fix a session identifier in a victim's browser and then reuse it to take over the logged-in session.","audience":"businesses","category":"other","nicknames":[],"who_cares":["php","self-hosted","smart-attendance-system"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker takes over a logged-in user session remotely","analyst_note":"Confirm the affected parameter and session handling in login.php and whether a fixed version or patch exists; the sources give no fix or check.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["not-deployed"],"who_is_affected":"Organizations running the SourceCodester Smart Attendance System with QR Code Scanner 1.0 web application are exposed through its login page. The sources do not say which configurations or deployments are affected beyond the login.php file. Teams that do not run this application can skip it.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00069,"input_tokens":4550,"output_tokens":469,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the affected parameter and session handling in login.php and whether a fixed version or patch exists; the sources give no fix or check.","search":"'-125078':14A,17A '-2026':13A,16A '-384':49B '1.0':42B,111C 'affect':113C 'attack':9A,62B,128C,146C 'attend':3A,32B,36B,105C 'attendance':19A 'browser':73B 'code':23A,40B,109C 'concept':88B 'cve':12A,15A 'cwe':48B 'discov':101C 'exploit':90B,134C 'file':119C 'fixat':7A,46B 'fixiat':126C 'flaw':47B,98C 'hijack':10A 'host':29B 'id':54B,68B 'known':66B 'launch':131C 'let':8A 'log':80B 'login':59B 'login.php':5A,51B,120C 'manipul':122C 'may':142C 'part':116C 'php':26B 'plant':64B 'proof':86B 'public':85B,140C 'qr':22A,39B,108C 'releas':137C 'remot':132C 'renew':57B 'report':83B,95B 'result':123C 'reus':75B 'scanner':24A,41B,110C 'secur':97C 'self':28B 'self-host':27B 'session':6A,11A,45B,53B,67B,125C 'smart':2A,18A,31B,35B,104C 'smart-attendance-system':30B 'sourcecodest':1A,34B,103C 'system':4A,20A,33B,37B,106C 'unknown':115C 'use':144C 'victim':71B,79B 'vuldb':82B 'wild':93B 'with':21A","nicknames":[],"mitigations":[],"who_affected":"Organizations running the SourceCodester Smart Attendance System with QR Code Scanner 1.0 web application are exposed through its login page. The sources do not say which configurations or deployments are affected beyond the login.php file. Teams that do not run this application can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["attendancesystemwithqrcodescanner","smartattendancesystemwithqrcodescanner"],"ptokens":["attendance","code","qr","scanner","smart","system","with"],"labels":["high","other","php","selfhosted","smartattendancesystem"],"campaign_type":null,"search_a":"'-125078':14A,17A '-2026':13A,16A 'attack':9A 'attend':3A 'attendance':19A 'code':23A 'cve':12A,15A 'fixat':7A 'hijack':10A 'let':8A 'login.php':5A 'qr':22A 'scanner':24A 'session':6A,11A 'smart':2A,18A 'sourcecodest':1A 'system':4A,20A 'with':21A","search_b":"'-384':49B '1.0':42B 'attack':62B 'attend':32B,36B 'browser':73B 'code':40B 'concept':88B 'cwe':48B 'exploit':90B 'fixat':46B 'flaw':47B 'host':29B 'id':54B,68B 'known':66B 'log':80B 'login':59B 'login.php':51B 'php':26B 'plant':64B 'proof':86B 'public':85B 'qr':39B 'renew':57B 'report':83B,95B 'reus':75B 'scanner':41B 'self':28B 'self-host':27B 'session':45B,53B,67B 'smart':31B,35B 'smart-attendance-system':30B 'sourcecodest':34B 'system':33B,37B 'victim':71B,79B 'vuldb':82B 'wild':93B","search_c":"'1.0':111C 'affect':113C 'attack':128C,146C 'attend':105C 'code':109C 'discov':101C 'exploit':134C 'file':119C 'fixiat':126C 'flaw':98C 'launch':131C 'login.php':120C 'manipul':122C 'may':142C 'part':116C 'public':140C 'qr':108C 'releas':137C 'remot':132C 'result':123C 'scanner':110C 'secur':97C 'session':125C 'smart':104C 'sourcecodest':103C 'system':106C 'unknown':115C 'use':144C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T00:17:06+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125078","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125078","severity":null,"published_at":"2026-11-10T00:17:06+00:00","modified_at":"2026-11-10T00:17:06+00:00","first_seen_at":"2026-11-10T00:28:41+00:00","fetched_at":"2026-11-10T00:28:41+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-125078:2363","url":"https://vuldb.com/vuln/433183","severity":null,"published_at":"2026-11-10T00:32:36+00:00","modified_at":"2026-11-10T00:32:36+00:00","first_seen_at":"2026-11-10T00:32:36+00:00","fetched_at":"2026-11-10T00:32:36+00:00","note":"Read VulDB VDB-433183 (CNA, secondary; the GitHub advisory/PoC it cites is not linked there, so not read). CWE-384, login.php, no named parameter, unauth remote, needs user interaction, public PoC reported by VulDB, no vendor fix or countermeasure known. Nothing verified: no vendor page exists.","cites":["https://vuldb.com/vuln/433183"]}],"documents":[{"id":112214,"url":"https://vuldb.com/vuln/433183","title":"VulDB VDB-433183: Smart Attendance System login.php session fixation","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}