# CVE-2025-50486: PHPGurukul Car Rental Project improper session invalidation in update-password.php

Source: https://junglewise.ai/threats/cve-2025-50486-phpgurukul-car-rental-project-improper-session-invalidation-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-07-28. Updated: 2026-07-05  
License: CC BY 4.0 with a link back

CVE-2025-50486 · Severity: high · CVSS 7.1 · Published 2025-07-28

A vulnerability exists in the PHPGurukul Car Rental Project, a web application used for managing vehicle rentals. The software fails to properly clear or refresh user sessions when a password is changed. This could allow an attacker to hijack a user's active session, potentially leading to unauthorized account access and the ability to view or modify customer data.

Vendors: [Phpgurukul](https://junglewise.ai/threats/vendors/phpgurukul).

## Quick answers

**Is CVE-2025-50486 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-50486 being exploited in the wild.

**How severe is CVE-2025-50486?** High severity, with a CVSS score of 7.1, published 28 July 2025.

**Which products and versions are affected?** Phpgurukul Car Rental Project 3.0.

**Is there a fix for CVE-2025-50486?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-50486 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2025-50486?** Check whether you run Phpgurukul Car Rental Project or Phpgurukul E-Diary Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A session management vulnerability (CWE-613) exists in PHPGurukul Car Rental Project v3.0 within the update-password.php component. The application fails to properly invalidate or rotate session identifiers upon sensitive actions like password updates. An attacker can exploit this by fixing or capturing a session ID; if a victim authenticates or continues using the application under that ID, the attacker maintains access even after credentials have been changed. This requires some user interaction (UI:R) to establish the initial session state but allows for high confidentiality impact through session hijacking.

## Affected products

- PHPGurukul Car Rental Project 3.0

## Timeline

- 2025-07-28: advisory: NVD publication date

## References

- [http://car.com/](http://car.com/)
- [https://github.com/sahel0708/CVE/tree/main/CVE-2025-50486](https://github.com/sahel0708/CVE/tree/main/CVE-2025-50486)

## Related threats

- [PHPGurukul e-Diary Management System improper session invalidation](https://junglewise.ai/threats/cve-2025-50492-phpgurukul-e-diary-management-system-improper-session)