What is the CVSS score of CVE-2025-50485?

CVE-2025-50485 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.4%.

Which versions of Online Course Registration are affected by CVE-2025-50485?

PHPGurukul Online Course Registration v3.1 contains a session management vulnerability that allows attackers to maintain persistent unauthorized access to CRM accounts even after users change their…

Is there a public PoC exploit available for CVE-2025-50485?

Yes, a public proof-of-concept exploit is available for CVE-2025-50485. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2025-50485?

WITHIN 24 HOURS: Conduct inventory of all PHPGurukul v3.1 instances and affected user base; document last password change events. WITHIN 7 DAYS: Force global session termination across all deployed instances; implement mandatory session re-authentication after any password change; enable IP address-based session binding to block replayed tokens. WITHIN 30 DAYS: Assess upgrade path to patched PHPGurukul version or replace with alternative CRM; deploy continuous monitoring for session anomalies (impossible travel, multi-IP logins).

Online Course Registration CVE-2025-50485

HIGH

Insufficient Session Expiration (CWE-613)

2025-07-28 cve@mitre.org

PHP Information Disclosure Online Course Registration

7.1

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

vuln.today AI

4.2 MEDIUM

AC:H because the attacker must first obtain a valid session token; UI:R for the victim's password change; C:L/I:L as impact is limited to a single hijacked CRM account.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 05, 2026 - 02:00 vuln.today

DescriptionCVE.org

Improper session invalidation in the component /crm/change-password.php of PHPGurukul Online Course Registration v3.1 allows attackers to execute a session hijacking attack.

AnalysisAI

Session hijacking in PHPGurukul Online Course Registration v3.1 stems from the /crm/change-password.php component failing to invalidate existing sessions after a password change, letting an attacker who has captured or replayed a victim's session identifier retain authenticated access even after the credential is rotated. Publicly available exploit code exists (GitHub), but the flaw is not listed in CISA KEV and carries a low EPSS score of 0.40% (32nd percentile), indicating limited observed exploitation. The issue chiefly threatens confidentiality of the affected user's CRM account.

Technical ContextAI

PHPGurukul Online Course Registration is a small PHP/MySQL web application distributed as free source code for academic and learning-management use. The root cause is CWE-613 (Insufficient Session Expiration): the password-change routine in /crm/change-password.php updates the stored credential but does not destroy or regenerate the server-side session, so a session token that was valid before the change remains valid afterward. Because PHP session handling here does not tie session lifetime to credential state, a token obtained through sniffing, fixation, or reuse continues to authenticate the holder. The single affected build is identified by cpe:2.3:a:phpgurukul:online_course_registration:3.1.

RemediationAI

No vendor-released patch identified at time of analysis; the references contain only a proof-of-concept (https://github.com/VasilVK/CVE/tree/main/CVE-2025-50485) and no fixed release for PHPGurukul Online Course Registration. As a code-level compensating control, modify /crm/change-password.php to call session_regenerate_id(true) and destroy all other active sessions for the account immediately after a successful password update, forcing re-authentication. Operators should additionally enforce HTTPS site-wide with the Secure and HttpOnly cookie flags to reduce token capture (trade-off: requires TLS configuration), set short session.gc_maxlifetime and cookie lifetimes to shrink the reuse window (trade-off: more frequent logins), and restrict access to the /crm/ interface to trusted networks or VPN where feasible. Monitor for the same session ID used from multiple IPs as a detection stopgap until an upstream fix is confirmed.