A critical session management vulnerability in PHPGurukul e-Diary Management System v1 permits unauthenticated attackers to perform session hijacking, posing a severe risk to user account integrity.

This vulnerability involves improper session invalidation within the /edms/change-password.php script, which fails to securely terminate sessions upon password changes. The vulnerability is exploitable by unauthenticated remote attackers.

Successful exploitation of this flaw allows an attacker to hijack active user sessions, leading to unauthorized access to sensitive personal data and administrative functions within the system. With a CVSS score of 7.5, this high-severity vulnerability represents a significant risk to organizational confidentiality and integrity, as it bypasses standard authentication controls to potentially grant full control over affected user accounts.

Immediate Action: Since a vendor-provided patch is not currently available, administrators should restrict access to the /edms/change-password.php endpoint via network controls or, if possible, disable the e-Diary Management System until a security update is released by the vendor.

Proactive Monitoring: Review web server access logs for anomalous requests directed at the change-password component, particularly those originating from unknown or suspicious IP addresses.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block or inspect traffic targeting the /edms/change-password.php file to identify and reject potentially malicious session manipulation attempts.

Public Exploit Available: Yes (a public proof-of-concept exists, attributed to the researcher's GitHub repository linked in the CVE record).

Given the potential for complete account takeover, organizations utilizing PHPGurukul e-Diary Management System v1 must treat this vulnerability with high urgency. Until an official patch is released, prioritize isolating the affected application from public-facing networks and monitor all traffic to the vulnerable component for signs of misuse.