What is the CVSS score of CVE-2025-50486?

CVE-2025-50486 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.4%.

Which versions of PHPGurukul Car Rental are affected by CVE-2025-50486?

PHPGurukul Car Rental Project v3.0 allows attackers to maintain unauthorized access to customer accounts even after credential resets, enabling fraud and unauthorized rental system access.

Is there a public PoC exploit available for CVE-2025-50486?

Yes, a public proof-of-concept exploit is available for CVE-2025-50486. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2025-50486?

Within 24 hours: (1) Identify all systems running PHPGurukul v3.0; (2) Force logout all active sessions and require re-authentication; (3) Enable detailed logging on /carrental/ endpoints. Within 7 days: (1) Implement code fix in /carrental/update-password.php to invalidate all user sessions upon password change; (2) Deploy session timeout policy (15 minutes maximum) with mandatory re-login for sensitive operations; (3) Review access logs for unauthorized session reuse patterns. Within 30 days: (1) Upgrade to PHPGurukul v3.1+ or migrate to alternative platform if v3.1+ unavailable; (2) Add session-handling security tests to CI/CD pipeline; (3) Conduct comprehensive security review of authentication layer.

PHPGurukul Car Rental CVE-2025-50486

HIGH

Insufficient Session Expiration (CWE-613)

2025-07-28 cve@mitre.org

PHP Information Disclosure E Diary Management System

7.1

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

vuln.today AI

7.1 HIGH

Network-reachable endpoint with low complexity and no attacker authentication, but victim interaction is required to trigger; high confidentiality from account takeover, low integrity, no availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 05, 2026 - 02:01 vuln.today

DescriptionCVE.org

Improper session invalidation in the component /carrental/update-password.php of PHPGurukul Car Rental Project v3.0 allows attackers to execute a session hijacking attack.

AnalysisAI

Session hijacking in PHPGurukul Car Rental Project v3.0 stems from the /carrental/update-password.php endpoint failing to invalidate existing sessions after a password change, allowing an attacker who has captured or been handed a valid session identifier to retain authenticated access even after the victim resets credentials. Publicly available exploit code exists (GitHub), but the issue is not in CISA KEV, and EPSS is modest at 0.40% (32nd percentile), indicating no evidence of widespread automated exploitation. Confidence is reduced by conflicting source metadata (see confidence notes).

Technical ContextAI

The affected component is a PHP web application (car rental management) built on the common PHPGurukul codebase, which typically uses native PHP session handling ($_SESSION) backed by cookies. The root cause is CWE-613 (Insufficient Session Expiration): update-password.php processes a credential change without calling session_regenerate_id()/session_destroy() or otherwise expiring pre-existing sessions, so a session token remains valid across the security-relevant event of a password reset. This defeats the primary defensive purpose of a password change - revoking access for a session that may already be compromised.

RemediationAI

No vendor-released patch version is identified at time of analysis for PHPGurukul Car Rental v3.0. As specific compensating controls: modify update-password.php to call session_regenerate_id(true) and invalidate all prior sessions immediately after a successful password change, and force re-authentication (trade-off: users are logged out on all devices, which is the intended security behavior). Set session cookies with HttpOnly, Secure, and SameSite=Strict to reduce token theft (trade-off: SameSite may affect cross-site flows, generally negligible here), enforce short session idle timeouts, and rotate the session ID on login to counter fixation. Because PHPGurukul is a widely-copied educational codebase often deployed unmodified, restrict administrative endpoints via IP allowlisting or place the app behind authenticated reverse-proxy access where feasible. Monitor the GitHub advisory (https://github.com/sahel0708/CVE/tree/main/CVE-2025-50486) and PHPGurukul releases for an official fix.