Student Result Management System CVE-2025-50490

Exploitation targets the /elms/emp-changepassword.php password-change flow and requires the attacker to already possess or capture a valid employee/admin session token, because the vulnerability is that the application fails to invalidate existing sessions after a password change rather than minting a session from nothing. The limiting factor is precisely this prerequisite: the attacker must acquire a live session identifier (via cookie theft, shared machine, or network interception), so it is not blind unauthenticated code execution despite the PR:N CVSS metric. The app must be deployed and reachable over the network, and the target account must have had its password changed while the stale session remained active.

Signals are mixed and partly contradictory. The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) rates the impact as pure Availability with no Confidentiality or Integrity effect - which is inconsistent with a session-hijacking/account-takeover vulnerability, where the real impact is Confidentiality and Integrity of the hijacked account, not Availability. This suggests the NVD scoring was applied mechanically and should be verified with the source. EPSS is low (0.52%, 40th percentile) and the CVE is not in CISA KEV, indicating no evidence of widespread or automated exploitation. A public POC exists, which raises opportunistic risk, but exploitation realistically depends on the attacker first obtaining a valid session token. Net: this is a genuine but modest-priority issue - meaningful where the app is internet-exposed, but not an emergency, and its low deployment footprint further reduces aggregate risk.

An attacker obtains a valid employee session identifier (for example via a shared or previously compromised browser, network capture, or a leaked cookie). Even after the legitimate user changes their password through emp-changepassword.php, the old session is not invalidated, so the attacker replays the captured session token and continues to operate as the authenticated employee. A public POC is available demonstrating the session-hijacking condition.