Online Library Management System CVE-2025-50488

Exploitation targets the /library/change-password.php workflow of PHPGurukul Online Library Management System v3.0 and requires the attacker to possess or replay a valid session token belonging to a logged-in user; the CVSS UI:R flag indicates victim interaction is part of the chain (e.g., the victim initiating a password change or being induced to authenticate a session the attacker controls). Limiting factors: the attacker must first acquire the session identifier (through theft, fixation, or shared-session access), the target must be a running v3.0 instance, and network reachability to the application is needed. The core weakness that enables the attack is that a password change fails to expire prior sessions, so the practical prerequisite is control over or knowledge of an existing session rather than any application-level privileges.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N, score 7.1) describes network-reachable, low-complexity exploitation requiring no privileges but requiring user interaction, with high confidentiality and low integrity impact. The PR:N combined with a session-hijacking mechanism is somewhat contradictory - hijacking a session normally presupposes the attacker acquires a valid session token (e.g., via theft, fixation, or a shared/leaked cookie), so the practical precondition is access to a victim's session artifact rather than truly zero prerequisites; verify the exact attack precondition with the researcher POC. EPSS is low (0.39%, 31st percentile) and the CVE is not in CISA KEV, so this is not a mass-exploited priority, but publicly available exploit code raises the practical risk for exposed instances. Overall this is a real but moderate, opportunistic risk best prioritized for internet-facing deployments of this niche PHP application rather than as an urgent enterprise-wide emergency.

An attacker obtains a victim's valid session cookie (for example via a shared computer, network interception on a non-TLS deployment, or a session fixation lure requiring the victim to act) and, because change-password.php does not invalidate existing sessions, continues to use that token to access the victim's library account even after the password is changed. Publicly available POC code (VasilVK GitHub) demonstrates the flaw, and the low attack complexity means a captured session can be replayed with minimal effort.