A critical session management vulnerability in PHPGurukul Student Result Management System v2.0 exposes the application to session hijacking attacks by unauthenticated remote actors.

The application fails to properly invalidate sessions within the /elms/emp-changepassword.php component, which enables unauthenticated attackers to hijack active user sessions.

Successful exploitation allows an attacker to gain unauthorized access to administrative or user accounts without providing valid credentials. This vulnerability carries a CVSS score of 7.5, indicating a high risk that could lead to full data compromise, unauthorized modification of student records, or complete system takeover.

Immediate Action: Since no official patch is currently available, administrators should restrict access to the affected module or consider disabling the vulnerable component until a vendor security update is released.

Proactive Monitoring: Monitor server access logs for anomalous traffic patterns directed at the /elms/emp-changepassword.php endpoint, particularly from unauthorized or unexpected IP addresses.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter malicious requests attempting to exploit session management flaws, and enforce strict network access controls to limit exposure of the management interface.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the provided GitHub repository reference.

Given the availability of a public proof-of-concept and the high severity of potential session hijacking, immediate mitigation is required. Organizations using PHPGurukul Student Result Management System v2.0 should prioritize restricting access to the management interface and monitor for vendor updates to resolve this flaw permanently.