A critical session management vulnerability in PHPGurukul Student Result Management System v2.0 exposes users to session hijacking attacks.

The application fails to properly invalidate sessions within the /srms/change-password.php component. This flaw allows an unauthenticated attacker to perform session hijacking, potentially gaining unauthorized access to active user sessions.

The ability for an attacker to hijack active sessions presents a significant risk to data integrity and user privacy. Successful exploitation could lead to unauthorized access to administrative or student records, potentially resulting in data theft or unauthorized modification of academic information. With a CVSS score of 7.5, this high severity vulnerability necessitates immediate attention to prevent compromise.

Immediate Action: Since a specific patch is currently unknown, administrators should restrict access to the /srms/change-password.php endpoint or disable the affected module entirely if it is not business-critical.

Proactive Monitoring: Monitor server access logs for anomalous traffic patterns directed at the change-password.php file, specifically looking for repeated requests or suspicious session tokens.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block or inspect traffic hitting the vulnerable endpoint to prevent unauthorized session manipulation attempts.

Public Exploit Available: Yes, a public proof-of-concept exists via the researcher's GitHub repository.

Given the availability of a public proof-of-concept and the high severity of session hijacking, organizations using PHPGurukul Student Result Management System v2.0 must prioritize mitigation. Administrators should implement the suggested WAF rules and restrict access to the vulnerable component while awaiting official guidance or a security update from the vendor.