What is the CVSS score of CVE-2025-50494?

CVE-2025-50494 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.5%.

Which versions of Car Washing Management System are affected by CVE-2025-50494?

PHPGurukul Car Washing Management System v1.0 contains an unpatched session hijacking vulnerability in its credential change function that enables attackers to maintain unauthorized access to doctor…

Is there a public PoC exploit available for CVE-2025-50494?

Yes, a public proof-of-concept exploit is available for CVE-2025-50494. Prioritise patching immediately. EPSS: 0.5%.

How to fix or mitigate CVE-2025-50494?

Within 24 hours: Locate and document all production instances of PHPGurukul Car Washing Management System v1.0 and identify affected users/departments. Within 7 days: Implement interim controls (mandatory session termination on password change, enforce session timeout to 4 hours maximum, restrict /doctor/change-password.php access) or begin migration to a supported alternative product. Within 30 days: Complete remediation through either application migration or secure retirement.

Car Washing Management System CVE-2025-50494

HIGH

Improper Input Validation (CWE-20)

2025-07-28 cve@mitre.org

Information Disclosure PHP Car Washing Management System

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.4 HIGH

Session hijacking yields account confidentiality/integrity loss not availability, so C:H/I:H/A:N; AC:H because a valid session token must first be obtained.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 05, 2026 - 01:49 vuln.today

DescriptionCVE.org

Improper session invalidation in the component /doctor/change-password.php of PHPGurukul Car Washing Management System v1.0 allows attackers to execute a session hijacking attack.

AnalysisAI

Session hijacking in PHPGurukul Car Washing Management System v1.0 allows attackers to retain or reuse a doctor account session because the /doctor/change-password.php component fails to invalidate existing sessions after a credential change, publicly available exploit code exists (per the referenced GitHub PoC), though EPSS estimates only a 0.50% exploitation probability and the issue is not on CISA KEV. No public exploit identified as actively used in the wild; the flaw affects only the single unpatched v1.0 release of this niche PHP application.

Technical ContextAI

The affected software is PHPGurukul Car Washing Management System v1.0, a small PHP/MySQL web application distributed as a free source package for managing car-wash bookings and staff. The vulnerable component is the doctor-facing password change endpoint (/doctor/change-password.php). Although the CVE is tagged CWE-20 (Improper Input Validation), the described behavior - sessions remaining valid after a password change - is more precisely Insufficient Session Expiration / Improper Session Invalidation (CWE-613): the application does not destroy or regenerate server-side session identifiers when credentials are updated, so previously established PHP session cookies continue to authenticate. The single CPE, cpe:2.3:a:phpgurukul:car_washing_management_system:1.0, confirms only version 1.0 is in scope.

RemediationAI

No vendor-released patch identified at time of analysis, and no fixed version number is provided in the source data - do not assume a later release resolves it without confirming with PHPGurukul. As specific compensating controls: modify /doctor/change-password.php to call session_regenerate_id(true) and destroy the prior session immediately after a successful password update, forcing re-authentication (trade-off: the user is logged out on all devices, which is the intended secure behavior). Enforce short session lifetimes and idle timeouts to shrink the window in which a stolen session remains usable (trade-off: more frequent logins). Set session cookies with HttpOnly, Secure, and SameSite attributes and serve the application only over TLS to reduce the chance of a token being stolen in the first place. Restrict administrative/doctor panel access to trusted networks or behind a VPN as an interim control. The only actionable reference is the PoC at https://github.com/VasilVK/CVE/tree/main/CVE-2025-50494, useful for validating the fix.