EUVD-2026-92938
GHSA-cgmr-jfr8-jrp2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to login system
-
DeliveryCraft request to change-password.php
-
ExploitTamper with currentpassword argument
-
ExecutionBypass authorization check
-
ImpactChange password without valid credential
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation targets the Change Password Handler specifically at loginsystem/admin/change-password.php, by manipulating the 'currentpassword' parameter to trigger incorrect authorization (CWE-863). Per the CVSS vector (PR:H), an authenticated session with privileges is required, which materially limits exploitation to users who already have an account/access - it is not remote-unauthenticated. The exact mechanism (e.g., whether the current-password check can be omitted or spoofed) is not fully detailed in the description and should be confirmed against the public POC. Limiting factors: authentication is required, impact is confined to low confidentiality/integrity/availability within a single scope, and the affected software is version 3.3 of the PHPGurukul User Registration & Login and User Management System. |
| Impact | This is a low-priority issue despite being network-reachable. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N) with VC:L/VI:L/VA:L yields a base score of only 2.0, reflecting an authenticated flaw with limited impact. The exploitation status is: publicly available exploit code exists (GitHub POC by CyberShailendra1); this is NOT in CISA KEV and no EPSS score was provided, so there is no evidence of active exploitation or widespread mass-scanning. The weakness is CWE-863 (incorrect authorization) in the change-password handler, meaning the impact is a broken-authentication/authorization edge case rather than code execution or data exfiltration. Signals are internally consistent: low CVSS, low impact metrics, POC-but-no-KEV, all pointing to a minor, locally-scoped authorization bug. NOTE: the vector specifies PR:H (high privileges required), which is unusually strict for a 'change password' flaw - a broken-auth bug in password change more plausibly requires only a low-privileged authenticated session (PR:L); this discrepancy should be verified against the POC. EPSS data is missing and cannot be used to refine the probability estimate. |
| Exploit ScenarioDerived | An authenticated user of the PHPGurukul User Registration & Login system submits a crafted request to loginsystem/admin/change-password.php, manipulating the 'currentpassword' argument to bypass the authorization/verification check and change a password without providing the correct existing credential. A public proof-of-concept exists on GitHub, lowering the barrier to reproduction, though exploitation still requires an authenticated session (per CVSS PR:H/PR:L) and attack complexity is low. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Unauthorized password changes are possible in PHPGurukul User Registration & Login and User Management System 3.3 because the Change Password Handler at loginsystem/admin/change-password.php fails to properly validate the 'currentpassword' parameter, an incorrect authorization flaw (CWE-863) that lets a caller manipulate the request and bypass the intended current-password check. Per the supplied CVSS 4.0 vector (PR:H), the attacker must already hold an authenticated session with privileges, so this is not reachable by unauthenticated remote users, and the assessed impact is limited to low confidentiality, integrity, and availability within a single security scope. Publicly available exploit code exists (a GitHub proof-of-concept repository is referenced), making the technique easy to reproduce, but no CISA KEV entry or EPSS score was provided, so confirmed active exploitation is not established by the available data; overall this is a low-priority issue despite being network-reachable.
RemediationAI
No vendor-released patch was identified at time of analysis, and there is no fixed version to upgrade to in the supplied data, so remediation must rely on compensating controls while tracking the VulDB advisory (https://vuldb.com/vuln/413696) and the vendor site (https://phpgurukul.com/) for an update. The most direct mitigation is to restrict network access to loginsystem/admin/change-password.php using web-server or reverse-proxy ACLs (IP allowlisting, requiring VPN or administrative network placement); the trade-off is that legitimate remote administrators lose direct access and must route through the restricted path. A second control is to add a server-side check that ties the password change to the session's authenticated identity and re-validates the stored current password against the database rather than any client-supplied value, implemented as a code-level patch or virtual patch; this requires developer effort and must be re-applied if the application is reinstalled. Detection-side, log and alert on POSTs to change-password.php with anomalous or missing 'currentpassword' values and on unexpected password-change events, and consider a WAF rule blocking parameter tampering on that endpoint - noting that WAF coverage is signature-dependent and bypassable. Because exploit code is publicly available, treat the proof of concept at https://github.com/CyberShailendra1/phpgurukul-change-password-broken-auth as confirmation of the technique and prioritize applying the endpoint restriction immediately, accepting that it degrades administrative convenience rather than removing the underlying authorization defect. This product is commonly deployed for learning and demonstrations; if it is used only in non-production contexts, the appropriate action is to remove it from any internet-reachable host entirely.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is a PHP-based web application, PHPGurukul's User Registration & Login and User Management System, and the vulnerable code path is the administrative change-password handler in loginsystem/admin/change-password.php. The root cause class is CWE-863 (Incorrect Authorization): the handler performs its credential/authorization check on the user-supplied 'currentpassword' argument in a way that can be manipulated, so the server does not correctly establish that the request originates from a party entitled to change the target account's password. The single CPE entry, cpe:2.3:a:phpgurukul:user_registration_&_login_and_user_management_system:*:*:*:*:*:*:*:*, uses a wildcard version, meaning the identifier does not pin a specific release even though the disclosure is scoped to version 3.3, so operators should treat any deployed copy of this product as potentially affected until the vendor clarifies. Underlying technologies are PHP with the typical login/session handling of a teaching-grade management system; the CVSS 4.0 vector shows network attack vector (AV:N), low attack complexity (AC:L), no attack prerequisites (AT:N), high privileges required (PR:H), no user interaction (UI:N), and low impact across confidentiality, integrity and availability with no subsequent-system impact (SC/SI/SA:N), with an exploit-maturity value of E:P reflecting the publicly available proof of concept. The precise bypass mechanism - for example, whether the current-password comparison can be skipped, spoofed, or pointed at a different account - is not detailed in the available description and should be confirmed by reviewing the public proof-of-concept and the application source.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Network-reachable change-password endpoint with low complexity; a broken-auth password-change flaw realistically needs only a low-privileged authenticated session (PR:L), with limited C/I/A impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was determined in PHPGurukul User Registration & Login and User Management System 3.3. The impacted element is an unknown function of the file loginsystem/admin/change-password.php of the component Change Password Handler. This manipulation of the argument currentpassword causes incorrect authorization. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB