Description
A security vulnerability has been detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The impacted element is the function Session::checkLogin of the file include/session.php of the component Session Handler. Such manipulation of the argument cookname/cookid leads to incorrect comparison. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-10-13
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized session hijacking
Action: Assess Impact
AI Analysis

Impact

The vulnerable Session::checkLogin function uses an insecure comparison between the cookname and cookid session parameters, allowing an attacker to fake session verification. This flaw permits unauthorized session hijacking, effectively bypassing user identity checks and enabling an attacker to impersonate any user during the examination process.

Affected Systems

The flaw affects itsmeravitejak’s Online-Examination-System. All versions up to commit e6208e630b14657999bbfe4c9912302d2a1e2449 are vulnerable. Because the project uses a rolling release model, no explicit version numbers are available, so any code base that includes the legacy Session::checkLogin implementation before the commit is at risk.

Risk and Exploitability

The CVSS score of 6.9 indicates medium severity. EPSS is not available, but the vulnerability has been publicly disclosed and can be exploited remotely via crafted cookname/cookid values. The vulnerability is not currently listed in the CISA KEV catalog. Attackers could remotely inject malicious session parameters to hijack a user’s session, making the issue exploitable over the network wherever the login endpoint is reachable.

Generated by OpenCVE AI on October 13, 2026 at 06:50 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Review the project’s repository for a committed fix and deploy any updated code immediately.
  • If no patch is available, modify include/session.php to enforce strict identity comparison (===) on cookname and cookid, and validate these parameters before authentication.
  • Restrict public access to the session login endpoint with firewall rules or IP whitelists until a code fix is released.

Generated by OpenCVE AI on October 13, 2026 at 06:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 05:45:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The impacted element is the function Session::checkLogin of the file include/session.php of the component Session Handler. Such manipulation of the argument cookname/cookid leads to incorrect comparison. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
Title itsmeravitejak Online-Examination-System Session session.php checkLogin comparison
First Time appeared Itsmeravitejak
Itsmeravitejak online-examination-system
Weaknesses CWE-697
CPEs cpe:2.3:a:itsmeravitejak:online-examination-system:*:*:*:*:*:*:*:*
Vendors & Products Itsmeravitejak
Itsmeravitejak online-examination-system
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Itsmeravitejak Online-examination-system
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-13T13:26:23.453Z

Reserved: 2026-10-11T19:43:47.956Z

Link: CVE-2026-108969

cve-icon Vulnrichment

Updated: 2026-10-13T13:26:12.285Z

cve-icon NVD

Status : Deferred

Published: 2026-10-13T06:16:34.070

Modified: 2026-10-13T14:17:24.837

Link: CVE-2026-108969

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T07:23:27Z

Weaknesses