A critical session management vulnerability in PHPGurukul Online Library Management System v3.0 allows unauthenticated attackers to perform session hijacking, posing a severe risk to user account integrity.

This vulnerability involves improper session invalidation within the /library/change-password.php component. An unauthenticated attacker can leverage this flaw to hijack active user sessions.

The ability to hijack sessions allows unauthorized actors to impersonate legitimate users, potentially gaining access to sensitive library data or administrative functions. Given the CVSS score of 7.1, this vulnerability is considered high severity, as it facilitates unauthorized access without requiring prior authentication. Successful exploitation can lead to significant reputational damage and the compromise of confidential information stored within the system.

Immediate Action: Since no official patch is currently identified, administrators should restrict access to the /library/change-password.php endpoint or consider disabling the affected functionality until a vendor update is released.

Proactive Monitoring: Monitor server access logs for unusual patterns of password change requests or multiple sessions originating from disparate IP addresses for the same user account.

Compensating Controls: Implement a Web Application Firewall (WAF) to detect and block malicious requests targeting the /library/change-password.php file.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the research repository referenced by the CVE record.

The presence of a publicly available proof-of-concept significantly elevates the risk of exploitation for this vulnerability. Organizations using PHPGurukul Online Library Management System v3.0 must prioritize the implementation of compensating controls, such as WAF rules or network-level access restrictions, to protect against session hijacking. Monitor vendor channels closely for the release of an official security patch and apply it immediately upon availability.