CVE-2026-105233: Session Fixiation in kishor-23 food-waste-management-system

The vulnerability CVE-2026-105233 exists in the kishor-23 food-waste-management-system within the login.php file's login flow component. It allows an attacker to fixate a session by manipulating the PHPSESSID parameter remotely. This can lead to session fixation attacks where an attacker forces a user to use a known session ID, potentially compromising user sessions. The product lacks versioning, so specific affected versions cannot be enumerated. The issue was reported to the project but remains unaddressed, and no official patch or mitigation has been published.

Successful exploitation of this vulnerability could allow an attacker to hijack a user session by forcing the user to use a session ID known to the attacker. This can lead to unauthorized access to the victim's account or actions performed under the victim's session. The vulnerability is remotely exploitable without authentication and requires user interaction (UI:P). The overall impact is rated medium with limited confidentiality, integrity, and availability impacts.

No official fix or patch is currently available, and the vendor has not responded to the issue report. Users should monitor the vendor's communications for updates. Until a patch is released, consider implementing additional session management controls such as regenerating session IDs after login and validating session tokens to mitigate session fixation risks.