What is the CVSS score of CVE-2025-50492?

CVE-2025-50492 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.5%.

Which versions of e-Diary Management System are affected by CVE-2025-50492?

PHPGurukul e-Diary Management System v1.0 contains a session hijacking vulnerability that allows attackers to retain account access indefinitely, even after victims change passwords, creating…

How to fix or mitigate CVE-2025-50492?

Within 24 hours: Inventory all instances of PHPGurukul e-Diary v1.0 in production; issue user notification requiring password reset and cautioning of potential account compromise; enable comprehensive session logging. Within 7 days: Implement emergency controls-force session termination on any password change through code modification if necessary; enforce maximum 2-hour session inactivity timeout; deploy real-time alerting for impossible travel or anomalous session activity. Within 30 days: Initiate vendor contact for patch timeline; develop migration plan to alternative diary management solution or patched release; complete security review of all access logs for indicators of exploitation.

e-Diary Management System CVE-2025-50492

HIGH

Improper Input Validation (CWE-20)

2025-07-28 cve@mitre.org

Information Disclosure PHP E Diary Management System

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.4 HIGH

Network-reachable but requires first capturing a valid session token (AC:H); no prior app privileges needed (PR:N); session hijack compromises account confidentiality and integrity (C:H/I:H), not availability (A:N).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 05, 2026 - 01:55 vuln.today

DescriptionCVE.org

Improper session invalidation in the component /edms/change-password.php of PHPGurukul e-Diary Management System v1 allows attackers to execute a session hijacking attack.

AnalysisAI

Session hijacking in PHPGurukul e-Diary Management System v1.0 stems from the /edms/change-password.php endpoint failing to invalidate existing sessions after a password change, so a previously captured session identifier remains valid and grants continued authenticated access. Remote attackers who obtain a victim's session token can therefore retain or take over the account even after the legitimate user rotates their password. There is no CISA KEV listing and no confirmed active exploitation; a GitHub reference (VasilVK/CVE) tracking this CVE likely contains a proof-of-concept or write-up, though PoC status is not explicitly confirmed in the source data, and EPSS is low at 0.55% (42nd percentile).

Technical ContextAI

The affected component is a PHP web application (cpe:2.3:a:phpgurukul:e-diary_management_system:1.0) - one of PHPGurukul's freely distributed CRUD-style projects commonly used for learning and small deployments. The flaw lives in change-password.php, the account credential-rotation handler, which should destroy or regenerate all active session identifiers upon a successful password change. It does not, meaning server-side session state is not tied to the current credential. NVD assigns CWE-20 (Improper Input Validation), but the described behavior is more precisely a session-management defect in the CWE-613 (Insufficient Session Expiration) / CWE-384 (Session Fixation) family; the CWE mapping should be treated as loose. The 'Information Disclosure' tag reflects that a persisted session exposes the victim's authenticated data to whoever holds the stale token.

RemediationAI

No vendor-released patch identified at time of analysis - PHPGurukul projects are frequently distributed without formal security releases, and the only references are the vendor site (http://e-diary.com) and the CVE repository (https://github.com/VasilVK/CVE/tree/main/CVE-2025-50492). As a code-level fix, modify change-password.php to call session_regenerate_id(true) and destroy all other active sessions for the account immediately after a successful password update, and invalidate server-side session records rather than relying on cookie expiry. As compensating controls until a fix is applied: set short session-cookie lifetimes and idle timeouts to shrink the window a stale token stays valid (trade-off: more frequent re-logins); enforce HttpOnly, Secure, and SameSite=Strict cookie attributes to reduce token theft via script or cross-site requests; and where feasible restrict the application behind authenticated VPN/network ACLs to limit who can reach /edms/ endpoints (trade-off: reduced accessibility for legitimate remote users).