Mike has a good answer. I don't know why he was voted down (so I voted him back up). I just joined so I can't comment, but I would like to try to explain Mike's reasoning, because he is making a good point.
The original question was:
One of our scripts uses a $_SESSION variable and I'm not sure if that is vulnerable to manipulation from outside as a $_POST variable is...
I interpret this as asking, "is the user able to manipulate $_SESSION directly from the HTTP request, as he can do with $_COOKIE, $_POST, and $_GET?"
In other words, PHP will literally take user data from the request headers or body and stash into those three superglobals. But will it do the same thing for $_SESSION?
The answer is (in most cases) definitely no. The default session storage in PHP is "file", meaning that sessions are serialized and written to a file on the local filesystem. The user has no way to manipulate the contents of a session directly.
Now then, as others pointed out above, if you do something like this:
$_SESSION['foo'] = $_POST['bar'];
Then the user can now affect $_SESSION indirectly by affecting $_POST! Of course this is true, but I didn't see this as being the point of the question. The user can affect anything if you don't sanitize user inputs. The point is to know what inputs are not sanitized and know how to sanitize them before using them.
Karrax's criticism above was:
If XSS changes values on the client which is then used in the session variable you have successfully changed the $_SESSIOn by using XSS.
Of course this is true, but it's not the point of the question. By your logic, we can also say that, "malicious user input can launch a rocket to the moon." This is a true statement if somebody at NASA forgot to sanitize their user inputs in the rocket control application, but that's a problem with NASA's software, not an inherent risk in PHP.
Unfortunately, PHP doesn't make it obvious which superglobals are untainted and which are tainted. Understanding the distinction requires an intermediate level understanding of the HTTP protocol and how the PHP runtime process the HTTP request and response cycle.