What is the CVSS score of CVE-2025-50490?

CVE-2025-50490 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.5%.

Which versions of Student Result Management System are affected by CVE-2025-50490?

PHPGurukul Student Result Management System v2.0 contains a session management vulnerability enabling attackers to maintain unauthorized employee account access after password changes, risking…

Is there a public PoC exploit available for CVE-2025-50490?

Yes, a public proof-of-concept exploit is available for CVE-2025-50490. Prioritise patching immediately. EPSS: 0.5%.

How to fix or mitigate CVE-2025-50490?

Within 24 hours: Inventory for PHPGurukul Student Result Management System v2.0 in your environment; if found, note that publicly available exploit code exists and immediately restrict application network access via firewall/VPN to authorized networks only. Within 7 days: Enforce session timeout policies (15-30 minute inactivity limits), enable audit logging for password changes and employee authentication, and conduct system-wide employee password resets. Within 30 days: Request vendor patch availability timeline; if no patch emerges within 60 days, begin migration planning to a modern Student Information System with secure session architecture.

Student Result Management System CVE-2025-50490

HIGH

Improper Input Validation (CWE-20)

2025-07-28 cve@mitre.org

Information Disclosure PHP Student Result Management System

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.4 HIGH

Network-facing but requires capturing a valid session token (AC:H); success yields account takeover, so C:H/I:H, with no availability impact unlike the NVD vector.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 05, 2026 - 01:45 vuln.today

DescriptionCVE.org

Improper session invalidation in the component /elms/emp-changepassword.php of PHPGurukul Student Result Management System v2.0 allows attackers to execute a session hijacking attack.

AnalysisAI

Session hijacking in PHPGurukul Student Result Management System v2.0 stems from improper session invalidation in the employee change-password handler (/elms/emp-changepassword.php), letting attackers reuse session tokens that should have been terminated to take over an authenticated account. A public proof-of-concept exists (VasilVK GitHub), but there is no public exploit identified as actively exploited; EPSS is low at 0.52% (40th percentile) and it is not on CISA KEV. This is a niche PHP educational application, so real-world exposure is limited despite the network-facing nature of the flaw.

Technical ContextAI

The affected component is a PHP web application (PHPGurukul Student Result Management System, CPE cpe:2.3:a:phpgurukul:student_result_management_system:2.0) that manages student results with an employee/admin panel. The defect lives in emp-changepassword.php, the routine that lets an employee change their password. Proper design requires invalidating all pre-existing sessions when credentials change so that stolen or stale session identifiers cannot continue to authenticate. Here that invalidation does not occur (a session-fixation/session-management weakness, most precisely CWE-613 Insufficient Session Expiration), so a previously captured session cookie remains valid. NVD tags this as CWE-20 (Improper Input Validation), which does not accurately describe the root cause - the true class is broken session lifecycle management.

RemediationAI

No vendor-released patch identified at time of analysis - the references contain only the vendor homepage (http://phpgurukul.com) and a public POC (https://github.com/VasilVK/CVE/tree/main/CVE-2025-50490), with no fixed version. As specific compensating controls: modify emp-changepassword.php to destroy and regenerate the session on password change (call session_regenerate_id(true) and invalidate all other active sessions for that user), which directly closes the flaw but requires users to re-authenticate; shorten server-side session lifetimes and enforce idle/absolute timeouts to limit the window a stale token stays valid; set Secure, HttpOnly, and SameSite attributes on session cookies and enforce HTTPS to reduce the chance an attacker captures a token in the first place; and restrict access to the /elms/ employee panel to trusted networks or a VPN if the application is internet-facing. Because this is an unmaintained-style educational PHP app, evaluate migrating off it for production use.