What is the CVSS score of CVE-2025-50484?

CVE-2025-50484 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of PHPGurukul Small CRM are affected by CVE-2025-50484?

PHPGurukul Small CRM v3.0 contains a session hijacking vulnerability that allows attackers to maintain unauthorized access to user accounts even after password changes, directly compromising…

Is there a public PoC exploit available for CVE-2025-50484?

Yes, a public proof-of-concept exploit is available for CVE-2025-50484. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2025-50484?

Within 24 hours: Inventory all systems running PHPGurukul Small CRM v3.0 and document scope. Within 7 days: Force mandatory password reset for all users, implement immediate session termination, and deploy application controls to revoke all existing sessions upon password change with 30-minute idle session timeouts. Within 30 days: Confirm vendor patch roadmap; if no patch available within 90 days, initiate migration planning to alternative CRM platform.

PHPGurukul Small CRM CVE-2025-50484

HIGH

Insufficient Session Expiration (CWE-613)

2025-07-28 cve@mitre.org

Information Disclosure PHP Small Crm

7.1

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

vuln.today AI

5.9 MEDIUM

Network-reachable but requires obtaining a session and a victim password change (AC:H, UI:R); attacker holds no credentials of their own (PR:N); high confidentiality, low integrity, no availability impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 05, 2026 - 01:56 vuln.today

DescriptionCVE.org

Improper session invalidation in the component /crm/change-password.php of PHPGurukul Small CRM v3.0 allows attackers to execute a session hijacking attack.

AnalysisAI

Session hijacking in PHPGurukul Small CRM v3.0 stems from improper session invalidation in /crm/change-password.php, where existing session tokens are not revoked after a password change, letting an attacker who obtains or retains a valid session ID continue accessing the victim's authenticated account. Public exploit code exists (GitHub PoC by VasilVK), though there is no confirmed active exploitation (not in CISA KEV) and EPSS probability is low at 0.32% (24th percentile). Impact is primarily confidentiality of CRM data with limited integrity effect.

Technical ContextAI

The affected component is a PHP web application (PHPGurukul Small CRM, a lightweight open-source customer relationship management script), specifically its change-password.php handler. The root cause is CWE-613 (Insufficient Session Expiration): the application fails to invalidate or rotate active server-side sessions when a user changes their password. In a correctly designed PHP session model, a credential change should call session_regenerate_id() and destroy prior session identifiers so that any previously issued PHPSESSID cookie becomes worthless. Because Small CRM does not do this, a session captured, fixated, or left active before the password change remains valid afterward - negating the primary security benefit of changing a password after a suspected compromise. CPE cpe:2.3:a:phpgurukul:small_crm:3.0 identifies the exact affected build.

RemediationAI

No vendor-released patch is identified at time of analysis for PHPGurukul Small CRM v3.0, and no vendor advisory URL was provided. The core fix is code-level: force server-side session invalidation and identifier rotation on password change by calling session_regenerate_id(true) and destroying all prior sessions for the account within change-password.php, so pre-change session tokens can no longer authenticate. As compensating controls until an official fix is available, restrict network access to the CRM (place it behind a VPN or IP allowlist) to reduce remote reachability at the cost of legitimate remote-user convenience; enforce short PHP session lifetimes and idle timeouts to shrink the reuse window (side effect: more frequent re-logins); set session cookies with HttpOnly, Secure, and SameSite attributes and require full re-authentication after any sensitive account action to limit token capture. Review the public PoC at https://github.com/VasilVK/CVE/tree/main/CVE-2025-50484 to validate any local fix.