CVE-2026-82697
Received Received - Intake

Session Cookie Missing HttpOnly Flag in Student-Management-System

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: VulDB

Description
A security vulnerability has been detected in sambitraj Student-Management-System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. The impacted element is the function session_start. Such manipulation leads to cookie without 'httponly' flag. The attack may be launched remotely. A high complexity level is associated with this attack. The exploitability is regarded as difficult. The exploit has been disclosed publicly and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-82697
EUVD
EUVD-2026-68515

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
sambitraj student_management_system to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5 (inc)
sambitraj student-management-system to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1004 The product uses a cookie to store sensitive information, but the cookie is not marked with the HttpOnly flag.
CWE-732 The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves the Student-Management-System not setting the HttpOnly flag on session cookies. The session_start function is used without proper cookie configuration, allowing JavaScript to access session cookies via document.cookie. This can lead to session hijacking if an attacker executes malicious JavaScript.

Detection Guidance

To detect this vulnerability, inspect HTTP response headers for session cookies in login or dashboard endpoints. Check if the 'Set-Cookie' header includes 'HttpOnly' for session cookies. Use browser developer tools or tools like curl to examine headers. Example command: curl -I http://target/login.php | grep -i 'set-cookie'

Review PHP files calling session_start() without session_set_cookie_params() or session.cookie_httponly=1. Search for session_start() in codebases to identify affected files.

Impact Analysis

An attacker could steal session cookies by exploiting JavaScript execution, enabling them to impersonate users and access sensitive data. This risk increases if other vulnerabilities like stored XSS exist, compounding the threat of account takeover.

Compliance Impact

This vulnerability may violate GDPR and HIPAA by exposing session cookies, which could lead to unauthorized access to personal or health data. Compliance requires protecting session integrity and preventing data breaches.

Mitigation Strategies

Update PHP configuration to set session.cookie_httponly=1 in php.ini. Alternatively, modify affected files to call session_set_cookie_params(['httponly' => true]) before session_start().

Apply input validation and output encoding to prevent XSS, which could exploit this session theft risk. Monitor for unauthorized session access attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82697. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart