Executive brief
A vulnerability exists in the PHPGurukul Car Washing Management System, a web application used to manage car wash operations. Due to a flaw in how the system handles user sessions during password changes, an attacker can hijack a user's active session. This could allow an unauthorized person to take over accounts, potentially leading to the theft of customer data or disruption of business operations.
Technical details
A broken access control vulnerability exists in the /admin/change-password.php component (also referenced as /doctor/change-password.php in some documentation) of PHPGurukul Car Washing Management System v1.0. The root cause is improper session invalidation and handling, which allows for session fixation or hijacking. An attacker can set or capture a session ID and, once a legitimate user authenticates, use that session to gain unauthorized remote access to the victim's account. This enables the attacker to perform administrative actions, such as changing the account password, without valid credentials.
Affected products
- PHPGurukul Car Washing Management System 1.0
Timeline
- 2025-07-28: disclosed
- 2025-07-28: advisory