CVE-2026-86674: Session Fixiation in ningzichun Student Management System

This vulnerability in ningzichun Student Management System involves session fixation via the session_start function in login.php. An attacker can remotely manipulate session identifiers to fixate a session, which may allow unauthorized access to user sessions. The product lacks versioning, so no specific affected or fixed versions are known. The vulnerability was responsibly disclosed but remains unpatched. Public exploit code is available, though no active exploitation in the wild is confirmed.

Successful exploitation of this vulnerability can allow an attacker to fixate a session ID, potentially enabling unauthorized access to a victim's session. This could lead to impersonation of legitimate users within the system. The medium CVSS score reflects the moderate risk due to the remote attack vector and the requirement for user interaction.

No official fix or patch is currently available as the vendor has not responded to the issue report. Users should monitor the vendor's communications for updates. In the meantime, consider implementing additional session management controls such as regenerating session IDs after login and enforcing strict session expiration policies to mitigate the risk.