A vulnerability has been identified in tittuvarghese CollegeManagementSystem. The flaw allows an attacker to manipulate the UserAuthData input during a session_start call in /login-form.php, enabling session fixation. This code weakness, classified as CWE‑384, permits an adversary to bind a session identifier to an authenticated user until they log in, potentially compromising confidentiality and integrity of user sessions. The impact is that an attacker could hijack legitimate sessions without needing to guess credentials.

The affected product is tittuvarghese CollegeManagementSystem, version unspecified as the project does not use formal versioning. The vulnerability exists within the login-form.php routine that initiates sessions. Because no version control is present, all deployments of the current code base are potentially impacted until the code is patched or the application is updated.

The CVSS score of 5.3 indicates a medium severity and the absence of an EPSS rating leaves the likelihood of exploitation uncertain. The vulnerability is exploitable from a remote context, with publicly available exploit code; it has not yet been listed in the CISA KEV catalog. An attacker who can unauthenticatedly submit crafted UserAuthData may successfully fix the session ID and hijack a session, but only if session fixation is not mitigated by proper session regeneration and cookie handling.