Executive brief
PHPGurukul Small CRM, a customer relationship management tool, contains a security flaw in its password management component. An attacker can exploit this to hijack a user's active session, potentially gaining full access to their account and sensitive customer data. This could lead to unauthorized data modification or complete account takeover even if the user attempts to change their password.
Technical details
A session hijacking vulnerability exists in PHPGurukul Small CRM v3.0 due to insufficient session expiration (CWE-613) within the /crm/change-password.php component. The application fails to properly invalidate or rotate session identifiers during sensitive operations, such as password changes. An attacker can exploit this by fixing or capturing a session ID and maintaining access to the victim's account even after the victim authenticates or attempts to secure the account. This attack typically requires some user interaction (UI:R) to establish the shared session state but allows for remote unauthorized access (AV:N).
Affected products
- PHPGurukul Small CRM 3.0
Timeline
- 2025-07-28: advisory: NVD published the CVE record.
- 2025-07-28: disclosed: Vulnerability discovered and reported by Vasil VK.