CVE-2025-63563
📋 TL;DR
This vulnerability allows attackers with stolen session tokens to maintain access to user accounts even after legitimate users change their passwords. It affects all users of Summer Pearl Group Vacation Rental Management Platform versions before 1.0.2. The flaw enables session hijacking and unauthorized account access.
💻 Affected Systems
- Summer Pearl Group Vacation Rental Management Platform
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers maintain persistent access to compromised accounts, potentially accessing sensitive guest data, financial information, and administrative controls for vacation rental management.
Likely Case
Stolen sessions remain valid after password changes, allowing unauthorized access to user accounts and potentially exposing personal information and booking details.
If Mitigated
With proper session invalidation, attackers lose access immediately after password changes, limiting exposure to the window between session theft and password change.
🎯 Exploit Status
Requires session token acquisition through other means (phishing, XSS, MITM).
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.0.2
Vendor Advisory: https://github.com/Stolichnayer/Summer-Pearl-Group-Insufficient-Session-Expiration
Restart Required: No
Instructions:
1. Backup current installation. 2. Download version 1.0.2 from official source. 3. Replace vulnerable files with patched version. 4. Verify session invalidation works on password change.
🔧 Temporary Workarounds
Manual Session Invalidation
allImplement custom session cleanup on password change events
Implement session termination logic in password change handler
🧯 If You Can't Patch
- Force all users to log out and create new sessions after password changes
- Implement additional authentication factors for sensitive operations
🔍 How to Verify
Check if Vulnerable:
1. Log into application. 2. Note session token. 3. Change password. 4. Attempt to use old session token - if it still works, system is vulnerable.Check Version:
Check application version in admin panel or configuration filesVerify Fix Applied:
Repeat vulnerable check - old session tokens should be invalidated immediately after password change.📡 Detection & Monitoring
Log Indicators:
- Multiple active sessions for same user after password change
- Session reuse after password reset events
Network Indicators:
- Session tokens being used after password change timestamps
SIEM Query:
source="app_logs" AND (event="password_change" OR event="session_reuse") | stats count by user_id, session_id