The vulnerability originates from the session_start function not setting the HttpOnly flag on session cookies. When the flag is missing, an attacker who succeeds in injecting or executing script code on the page can read the cookie value, potentially allowing session hijacking or impersonation. The description indicates the exploit can be launched remotely, but it also notes a high level of complexity and that exploitation is considered difficult; this implies the attacker must first bypass other input controls or achieve code execution in order to leverage the vulnerability.

The affected product is the sambitraj Student‑Management‑System, available on GitHub. No specific release is pinned because the project uses a rolling release model, so any version built before the unidentified fix is potentially vulnerable.

The CVSS score of 6.3 classifies the vulnerability as medium severity. EPSS is not available and the vulnerability is not listed in CISA’s KEV catalog, so there is no known widespread usage of exploits. However, the attack may be launched remotely and is tied to a high complexity level; exploitability is regarded as difficult but not impossible. The lack of HttpOnly on the session cookie expands the attack surface for XSS or other client‑side vulnerabilities, potentially allowing attackers to steal session identifiers and compromise user accounts. Overall, the risk is significant enough to warrant timely remediation, especially if the system is exposed to untrusted traffic.