Executive brief
A security flaw exists in the PHPGurukul Blood Bank & Donor Management System, a platform used to manage blood donations and donor records. The system fails to properly refresh or invalidate user sessions when a password is changed, which could allow an unauthorized person to take over a legitimate user's account. If exploited, an attacker could gain access to sensitive donor information or modify account details without the user's knowledge.
Technical details
An insufficient session expiration vulnerability (CWE-613) exists in PHPGurukul Blood Bank & Donor Management System v2.4 within the /bbdms/change-password.php component. The application fails to properly invalidate existing sessions or rotate session identifiers during sensitive operations. An attacker can exploit this by fixing or capturing a session ID; once a victim authenticates or interacts with the change password functionality, the attacker can maintain access to the hijacked session. This allows for unauthorized remote access to the user panel and account takeover. A Proof of Concept (PoC) has been disclosed by researchers.
Affected products
- PHPGurukul Blood Bank & Donor Management System 2.4
Timeline
- 2025-07-28: advisory: CVE published by NVD/MITRE
- 2025-07-28: disclosed: Public GitHub repository with PoC details released by researcher Vasil VK