A session invalidation vulnerability in PHPGurukul Blood Bank & Donor Management System v2.4 poses a significant risk of account takeover via session hijacking.

The application fails to properly invalidate sessions within the /bbdms/change-password.php component, which allows an unauthenticated attacker to perform session hijacking.

Successful exploitation of this vulnerability allows unauthorized actors to hijack active user sessions, potentially leading to unauthorized access to sensitive blood donor and administrative data. With a CVSS score of 7.1, this flaw is categorized as High severity, representing a substantial risk to the confidentiality and integrity of the system.

Immediate Action: Since no official patch is currently available, administrators should restrict network access to the application and monitor for unauthorized session activity.

Proactive Monitoring: Review web access logs for unusual patterns or multiple successful logins originating from suspicious IP addresses.

Compensating Controls: Implement a Web Application Firewall (WAF) to detect and block malicious requests directed at the /bbdms/change-password.php endpoint.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the researcher's GitHub repository.

Given the availability of a public proof-of-concept and the potential for full account takeover, this vulnerability should be treated with high priority. Organizations using the affected software version must implement compensating controls immediately to prevent unauthorized access while waiting for an official vendor security update.