An issue in ProPhoenix Law RMS version 2022.2403.3.101 allows attackers to hijack user sessions by injecting a crafted 24‑character string into the ASP.NET_SessionId cookie. This flaw enables an attacker to impersonate a legitimate user, potentially accessing or modifying sensitive data and executing functions under the victim’s identity. The weakness is a session‑management vulnerability that can lead to unauthorized data disclosure and manipulation.

The affected product is ProPhoenix Law RMS version 2022.2403.3.101. No other vendors or additional versions were identified.

The EPSS score is <1% and the vulnerability is not listed in the CISA KEV catalog, which suggests limited public exploitation data. Attackers would need to inject a specifically crafted 24‑character cookie, implying the attack is client‑side and requires some knowledge of cookie handling or manual manipulation. While the CVSS score is 9.1, the nature of session hijacking coupled with the absence of public exploitation indicates a moderate to high risk, especially for organizations that expose the web application over the internet.