An attacker can insert a custom PHPSESSID cookie in the request and the vulnerable session handler echoes that value back in a Set‑Cookie response. The domain attribute of the cookie is derived from the internal DB_HOST hostname, which leaks the database server name to the client. With these two effects, a user who authenticates while using the attacker‑supplied cookie will have a session identifier that the attacker knows, enabling the attacker to hijack the user's authenticated session. This also discloses internal infrastructure details, which can facilitate further attacks. The weakness directly corresponds to‑384) and information exposure (CWE‑200).

Products from LabRedesCefetRJ named WeGIA are impacted. Versions prior to 3.8.6, including all releases that use the default sessionStart.php handler, are vulnerable. The problem affects every PHP page that relies on the sessionStart.php script to initialize the session. The recommended fix is to upgrade to WeGIA 3.8.6 or later, which removes the echo of the attacker‑supplied cookie and stops using DB_HOST as the cookie domain.

The CVSS score of 8.1 categorizes this flaw as high severity. EPSS data is not available, so the probability of exploitation is unknown, and the vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation. The most likely attack vector is remote and straightforward: an attacker simply sets a PHPSESSID cookie in a link or HTTP header; when a victim logs in using that cookie, the attacker gains immediate access to the victim’s session. No additional access requirements or privileged context are needed, making the attack feasible against any authenticated user.