Executive brief
A vulnerability exists in the PHPGurukul Online Library Management System, a platform used for managing digital and physical library catalogs. The software fails to properly refresh or invalidate user sessions when a password is changed, which could allow an attacker to take over a legitimate user's account. If exploited, an unauthorized person could gain full access to a user's profile, potentially viewing sensitive personal information or modifying account settings.
Technical details
A Broken Access Control vulnerability (CWE-613) exists in PHPGurukul Online Library Management System v3.0 within the /library/change-password.php component. The application fails to properly invalidate or rotate session identifiers during sensitive operations or upon authentication state changes. An attacker can exploit this by fixing a known session ID in a victim's browser; once the victim authenticates, the attacker can use the same session token to gain unauthorized remote access to the account. This allows the attacker to perform actions on behalf of the user, including further password modifications. A proof-of-concept is publicly available.
Affected products
- PHPGurukul Online Library Management System 3.0
Timeline
- 2025-07-28: advisory: NVD published the CVE record
- 2025-07-28: disclosed: Vulnerability details and PoC shared by researcher Vasil VK