What is the CVSS score of CVE-2025-50491?

CVE-2025-50491 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of Bank Locker Management System are affected by CVE-2025-50491?

PHPGurukul Bank Locker Management System v1.0 contains a critical session persistence flaw (CVE-2025-50491) enabling attackers with captured session tokens to impersonate banker accounts…

How to fix or mitigate CVE-2025-50491?

Within 24 hours: inventory all deployed PHPGurukul v1.0 instances and assess network exposure; contact vendor for patch timeline and confirm EOL status. Within 7 days: implement forced session termination on password change, enforce re-authentication for sensitive operations, and deploy idle session timeouts (≤30 minutes). Within 30 days: migrate to a patched version if vendor releases one, or replace the system with a vendor-maintained alternative; do not continue production use of v1.0 without comprehensive compensating controls.

Bank Locker Management System CVE-2025-50491

HIGH

Insufficient Session Expiration (CWE-613)

2025-07-28 cve@mitre.org

Information Disclosure PHP Bank Locker Management System

7.1

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

vuln.today AI

5.9 MEDIUM

Network-reachable but AC:H because the attacker must first obtain a valid session token; UI:R for the password-change action; impact is mainly confidentiality (C:H) with limited integrity and no availability effect.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 05, 2026 - 01:54 vuln.today

DescriptionCVE.org

Improper session invalidation in the component /banker/change-password.php of PHPGurukul Bank Locker Management System v1 allows attackers to execute a session hijacking attack.

AnalysisAI

Session hijacking in PHPGurukul Bank Locker Management System v1.0 lets remote attackers reuse valid session tokens because the /banker/change-password.php component fails to invalidate existing sessions after a password change. Any session token captured before the change (via a shared machine, network capture, or referrer/log leakage) remains usable, letting an attacker impersonate the banker account. A GitHub reference (VasilVK/CVE) is published for this issue, and EPSS risk is low at 0.34% (27th percentile) with no active exploitation reported.

Technical ContextAI

PHPGurukul Bank Locker Management System is a small PHP/MySQL web application distributed as free source for banks/branches to track locker allocations; the affected code path is the banker-side password change handler /banker/change-password.php. The root cause is CWE-613 (Insufficient Session Expiration): the application does not invalidate or rotate the server-side session identifier when a credential-changing event (password change) occurs. In a correctly built PHP app the change-password flow should call session_regenerate_id(true) and destroy all other active sessions for that user; here the old PHPSESSID stays authenticated, so a previously issued token continues to grant access even after credentials are altered. The single affected build is identified by CPE cpe:2.3:a:phpgurukul:bank_locker_management_system:1.0.

RemediationAI

No vendor-released patch identified at time of analysis for PHPGurukul Bank Locker Management System v1.0, and no fixed version is published in the available data. As specific compensating controls: modify /banker/change-password.php to call session_regenerate_id(true) immediately after a successful password update and explicitly destroy all other server-side sessions for that account (trade-off: forces re-login on other devices, which is desired here); shorten PHP session.gc_maxlifetime and set session.cookie_lifetime so idle tokens expire quickly (trade-off: more frequent re-authentication); enforce HTTPS with Secure, HttpOnly and SameSite cookie flags to reduce token capture; and restrict access to the /banker/ interface via IP allow-listing or a VPN so stolen tokens are only replayable from trusted networks. Consult the third-party writeup at https://github.com/VasilVK/CVE/tree/main/CVE-2025-50491 for reproduction detail, and verify any fix directly with PHPGurukul before assuming resolution.