A session invalidation vulnerability in PHPGurukul Bank Locker Management System v1 allows unauthenticated attackers to perform session hijacking, posing a significant risk to user account integrity.

The application fails to properly invalidate sessions within the /banker/change-password.php component. This flaw permits an unauthenticated attacker to hijack active user sessions, potentially leading to unauthorized access to banking management functions.

The ability to hijack sessions can lead to unauthorized access to sensitive financial data and administrative management controls within the Bank Locker Management System. Given the CVSS score of 7.1, this vulnerability is classified as High severity, as it directly compromises the confidentiality and integrity of user sessions and could lead to significant reputational and operational damage.

Immediate Action: As no official patch is currently available, administrators should restrict access to the /banker/ directory and monitor for unusual session behavior until the vendor releases a security update.

Proactive Monitoring: Review web server access logs for anomalous requests to the /banker/change-password.php endpoint and monitor for multiple logins or session tokens originating from inconsistent IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious traffic or detect session-related anomalies targeting the identified vulnerable endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists per the technical write-up provided in the GitHub reference.

Due to the presence of a public proof-of-concept and the potential for session hijacking, this vulnerability presents a credible risk to the platform. Organizations currently utilizing the PHPGurukul Bank Locker Management System v1 should prioritize the implementation of robust WAF rules and restrict network access to the affected administrative components while awaiting a formal vendor patch.