What is the CVSS score of CVE-2025-50487?

CVE-2025-50487 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of Blood Bank Management System are affected by CVE-2025-50487?

PHPGurukul Blood Bank & Donor Management System v2.4 contains a session persistence vulnerability (CVE-2025-50487) allowing attackers with captured authentication tokens to retain unauthorized access…

Is there a public PoC exploit available for CVE-2025-50487?

Yes, a public proof-of-concept exploit is available for CVE-2025-50487. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2025-50487?

24 hours: Identify all production instances of PHPGurukul v2.4; audit active user sessions and flag any opened before corresponding password-change timestamps for investigation. 7 days: Apply in-house code patch to /bbdms/change-password.php to force complete session invalidation on password change; reduce maximum session timeout to 4 hours; require multi-factor authentication for all staff and donor portal accounts. 30 days: Monitor vendor security advisory channels for official patch release; conduct forensic audit of session logs and password-change events from the past 90 days to identify potential unauthorized access; develop HIPAA breach notification procedures.

Blood Bank Management System CVE-2025-50487

HIGH

Insufficient Session Expiration (CWE-613)

2025-07-28 cve@mitre.org

PHP Information Disclosure Blood Bank Donor Management System

7.1

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

vuln.today AI

6.3 MEDIUM

Attacker needs a pre-existing valid session token, so PR:L rather than PR:N; UI:R for the password-change action; confidentiality-dominant impact with limited integrity and no availability effect.

3.1 AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 05, 2026 - 01:57 vuln.today

DescriptionCVE.org

Improper session invalidation in the component /bbdms/change-password.php of PHPGurukul Blood Bank & Donor Management System v2.4 allows attackers to execute a session hijacking attack.

AnalysisAI

Session hijacking in PHPGurukul Blood Bank & Donor Management System v2.4 stems from the /bbdms/change-password.php component failing to invalidate existing sessions after a password change, letting an attacker who obtains or captures a valid session token retain authenticated access even after the victim rotates credentials. Publicly available exploit code exists (GitHub, VasilVK), though the flaw is not listed in CISA KEV and carries a low EPSS score of 0.32% (24th percentile), indicating no evidence of widespread automated exploitation. The issue primarily threatens confidentiality of donor and blood-bank records in this niche PHP application.

Technical ContextAI

The affected software is PHPGurukul Blood Bank & Donor Management System, a small open-source PHP/MySQL web application (CPE cpe:2.3:a:phpgurukul:blood_bank_&_donor_management_system:2.4) used to manage blood inventory and donor records. The root cause is CWE-613 (Insufficient Session Expiration): the change-password.php workflow does not destroy or regenerate server-side session identifiers when a user updates their password, so previously issued session cookies remain valid. Secure session handling requires invalidating all active sessions (or at minimum regenerating the session ID) on credential change; the absence of this control means a compromised or intercepted session persists indefinitely until natural timeout.

RemediationAI

No vendor-released patch identified at time of analysis, as the references contain only a proof-of-concept (https://github.com/VasilVK/CVE/tree/main/CVE-2025-50487) and no PHPGurukul advisory or fixed release. As compensating controls, modify change-password.php to call session regeneration and destroy all prior server-side sessions on password change (e.g., regenerate the session ID and invalidate old session records), which forces re-authentication and closes the hijack window with the side effect of logging users out of other devices. Enforce short session-idle timeouts and set cookies with HttpOnly, Secure, and SameSite attributes to shrink the token-exposure surface, and require the application to be served exclusively over TLS to prevent cookie interception; restrict access to the /bbdms/ admin interface to trusted networks/VPN as an additional containment measure at the cost of remote convenience. Monitor the PHPGurukul site for an updated 2.4.x release and apply it once published.