What is the CVSS score of CVE-2025-50488?

CVE-2025-50488 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.4%.

Which versions of Online Library Management System are affected by CVE-2025-50488?

PHPGurukul Online Library Management System v3.0 contains a session hijacking vulnerability that allows attackers with access to valid session tokens to impersonate users indefinitely, even after…

Is there a public PoC exploit available for CVE-2025-50488?

Yes, a public proof-of-concept exploit is available for CVE-2025-50488. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2025-50488?

Within 24 hours: Audit all systems running PHPGurukul v3.0 and restrict public network access to /library/change-password.php using firewall or WAF rules. Within 7 days: Implement custom session termination logic that invalidates all active sessions when a password change is completed, and require re-authentication for the account. Within 30 days: Establish upgrade path to PHPGurukul v3.1 or later once vendor releases patched version, or migrate to alternative library management system with confirmed secure session handling.

Online Library Management System CVE-2025-50488

HIGH

Insufficient Session Expiration (CWE-613)

2025-07-28 cve@mitre.org

PHP Information Disclosure Online Library Management System Phpgurukul

7.1

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

vuln.today AI

5.9 MEDIUM

Network-reachable with no app privileges (PR:N) but requires obtaining a session token and victim interaction, raising complexity to AC:H; account access yields high confidentiality, low integrity, no availability impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 05, 2026 - 01:51 vuln.today

DescriptionCVE.org

Improper session invalidation in the component /library/change-password.php of PHPGurukul Online Library Management System v3.0 allows attackers to execute a session hijacking attack.

AnalysisAI

Session hijacking in PHPGurukul Online Library Management System v3.0 stems from improper session invalidation in /library/change-password.php, where sessions are not properly terminated after credential changes, allowing an attacker who obtains or reuses a still-valid session token to impersonate a victim. Publicly available exploit code exists (GitHub, VasilVK), though there is no public exploit identified as actively exploited in the wild and it is not listed in CISA KEV. EPSS is low at 0.39% (31st percentile), indicating limited predicted mass-exploitation activity despite the available POC.

Technical ContextAI

The affected component is a PHP web application (PHPGurukul Online Library Management System, CPE cpe:2.3:a:phpgurukul:online_library_management_system:3.0) commonly used as a small-scale library catalog and member management portal. The root cause is CWE-613 (Insufficient Session Expiration), where the change-password.php workflow fails to invalidate or rotate the existing session identifier after a security-relevant event such as a password change. In a correctly implemented flow, changing a password should terminate all other active sessions and issue a fresh session token; here, previously issued session cookies remain valid, so a captured or fixed session ID continues to grant authenticated access even after the account owner attempts to secure the account.

RemediationAI

No vendor-released patch identified at time of analysis - no fix version or official PHPGurukul advisory is present in the provided data. As compensating controls, configure the application/server to regenerate the session ID on every privilege or credential change and to invalidate all other active sessions when a password is changed (session_regenerate_id(true) and server-side session store invalidation), which directly addresses CWE-613 but may log users out of concurrent sessions. Enforce short session idle and absolute timeouts, set cookies with HttpOnly, Secure, and SameSite attributes to reduce token theft, and place the application behind a WAF or restrict administrative/member access to trusted networks or VPN to limit exposure while a code fix is developed. Monitor the POC repository (https://github.com/VasilVK/CVE/tree/main/CVE-2025-50488) and PHPGurukul for an official update, and given this is unmaintained-style niche software, consider migrating off it if no patch is released.