A flaw in the login.php file of the kishor-23 food‑waste‑management‑system allows an attacker to manipulate the PHPSESSID parameter, enabling session fixation. By controlling the session identifier before authentication, a malicious actor can bind a session to a victim and subsequently hijack that session once the victim logs in, granting unauthorized access to the application’s logged‑in user state. This vulnerability is identified as CWE‑384, reflecting improper session ID handling.

The only known affected vendor is kishor‑23 with the product food‑waste‑management‑system. The project does not use explicit versioning, so all revisions based on the committed code referenced by the CVE (411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c) may be impacted. The weakness resides exclusively in the login.php module of the Login Flow component.

The CVSS score of 5.3 indicates a moderate impact, while the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The flaw can be triggered remotely via crafted HTTP requests that alter the PHPSESSID value prior to authentication. Because the vulnerability relies on insecure session ID handling, an attacker who succeeds can hijack a victim’s session after login, potentially leading to unauthorized actions within the application. The lack of EPSS data limits precise exploitation likelihood estimates, but the public disclosure and remote attack vector raise concern.