CVE-2025-50489
📋 TL;DR
This vulnerability allows attackers to hijack user sessions in PHPGurukul Student Result Management System v2.0 by exploiting improper session invalidation in the password change functionality. Attackers can maintain access to accounts even after password changes, affecting all users of the vulnerable system.
💻 Affected Systems
- PHPGurukul Student Result Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain persistent unauthorized access to administrative accounts, potentially compromising student records, grades, and sensitive personal information.
Likely Case
Attackers hijack student or teacher accounts to view or modify grades, access personal information, or perform unauthorized actions within the system.
If Mitigated
Limited impact with proper session management controls, but still allows temporary unauthorized access until sessions naturally expire.
🎯 Exploit Status
Exploitation requires initial authentication but session hijacking can be automated. GitHub repository contains proof-of-concept code.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: http://phpgurukul.com
Restart Required: No
Instructions:
1. Check vendor website for security updates
2. If patch available, download and apply
3. Modify /srms/change-password.php to properly invalidate all existing sessions on password change
4. Test password change functionality
🔧 Temporary Workarounds
Manual Session Invalidation
allModify change-password.php to destroy all existing sessions for the user when password is changed
Edit /srms/change-password.php to add session_destroy() and regenerate session ID after password update
Session Timeout Reduction
allReduce session lifetime to limit exposure window
Set session.gc_maxlifetime to 1800 in php.ini or .htaccess
🧯 If You Can't Patch
- Implement web application firewall rules to monitor and block suspicious session activity
- Enable detailed logging of all password change attempts and session creations for monitoring
🔍 How to Verify
Check if Vulnerable:
1. Log into system
2. Change password
3. Attempt to use old session token - if it still works, system is vulnerableCheck Version:
Check system documentation or admin panel for version informationVerify Fix Applied:
1. Log into system
2. Change password
3. Attempt to use old session token - should be rejected
4. Verify new session ID is generated📡 Detection & Monitoring
Log Indicators:
- Multiple active sessions for same user ID
- Password changes without corresponding session invalidation
- Session IDs persisting after password reset
Network Indicators:
- Reuse of old session tokens after password change
- Multiple concurrent logins from different locations for same account
SIEM Query:
source="web_logs" (event="password_change" OR event="session_create") | stats count by user_id, session_id | where count > 1