CVE-2025-63529
BaseFortify
Publication date: 2025-12-01
Last updated on: 2025-12-02
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| shridharshukl | blood_bank_management_system | 1.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-384 | Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a session fixation issue in the Blood Bank Management System 1.0 login.php. It allows an attacker to set or predict a user's session ID before they authenticate. When the user logs in, the system continues to use the attacker-supplied session ID instead of generating a new one, enabling the attacker to hijack the authenticated session and access the victim's account without authorization.
How can this vulnerability impact me? :
This vulnerability can allow an attacker to gain unauthorized access to a victim's account by hijacking their authenticated session. This could lead to exposure of sensitive personal or medical information, unauthorized actions performed on behalf of the victim, and potential compromise of the system's integrity and confidentiality.