Attack Chain

1. Attacker performs reconnaissance to identify instances of the Online-Examination-System application.
2. Attacker inspects the session management implementation in the target environment.
3. Attacker crafts a malicious HTTP request targeting the include/session.php endpoint.
4. Attacker injects or modifies the cookname or cookid parameters within the request header or query string.
5. The server-side Session::checkLogin function fails to perform a strict comparison of the provided session parameters.
6. The authentication logic returns a successful session state despite the lack of valid credentials.
7. Attacker gains unauthorized access to the application as a registered user.
8. Attacker proceeds to perform administrative actions or exfiltrate data from the examination database.

Impact

Successful exploitation allows for full authentication bypass, granting attackers unauthorized access to the Online-Examination-System. This could lead to the exposure of sensitive examination data, student records, and administrative controls within the application. The full scope of impact depends on the specific deployment configuration and the sensitivity of the stored information.

Recommendation

• Monitor web application logs for unexpected access to include/session.php that does not correlate with standard login flows.
• Restrict external access to the Online-Examination-System until a patch is released by the project maintainers.
• Implement strict session validation logic at the application layer to mitigate the impact of the incorrect comparison flaw.
• Review all authentication-related code paths in custom PHP implementations that interface with the identified component.