ProPhoenix Law RMS: Session hijacking via crafted ASP.NET_SessionId cookie
Summary
ProPhoenix Law RMS v2022.2403.3.101 has a session handling flaw (CWE-384, session fixation). An attacker can inject a crafted 24-character string into the ASP.NET_SessionId cookie and hijack a user session. The CVE record rates the issue 9.1 (critical), with high impact on confidentiality and integrity. The public description does not explain the mechanism, and no fix or exploitation has been confirmed.
Affected
- ProPhoenix Law RMS v2022.2403.3.101 (per the CVE description)
- No other versions identified
Fixed in
Unknown.
Workaround
- Restrict access to the application to the internal network or VPN
- Enforce HTTPS and short session lifetimes
- Ask the vendor whether a configuration-level workaround exists for this version
Exploitation
- No evidence of exploitation in the wild (CISA SSVC: Exploitation none, Automatable yes, Technical Impact total)
- No public proof of concept found
Our recommendation
- Identify all instances of ProPhoenix Law RMS v2022.2403.3.101
- If they are reachable from the internet, restrict access first
- Ask ProPhoenix for a fixed version and a timeline
- Monitor the vendor page and NVD for updates and review session activity for anomalies
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- ProPhoenix Law RMS product page prophoenix.com
- CVE Brief archive (October 2026) cvebrief.com
- Strix: CVE-2024-34324 www.strix.ai
- CVE record (CVE List V5, JSON) raw.githubusercontent.com
- Preventing session hijacking and cookie theft in ASP.NET Core www.c-sharpcorner.com
- OWASP: Session Handling wiki.owasp.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 06:47.
Original description (NVD)
An issue in ProPhoenix Law RMS v2022.2403.3.101 allows attackers to execute a session hijacking attack via injecting a crafted 24-character string into the ASP.NET_SessionId cookie.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.