A critical session management vulnerability in PHPGurukul Car Washing Management System v1.0 enables session hijacking, posing a severe risk of unauthorized account access.

The application fails to properly invalidate sessions within the /doctor/change-password.php component. This flaw allows an unauthenticated attacker to perform session hijacking, potentially gaining unauthorized control over active user sessions.

The ability for an attacker to hijack active sessions directly threatens the integrity and confidentiality of the entire application. Successful exploitation could lead to full unauthorized access to user accounts, including administrative functions, which may result in data breaches, unauthorized data modification, or complete system compromise. With a CVSS score of 7.5, this high severity vulnerability requires immediate attention to prevent operational disruption and loss of sensitive information.

Immediate Action: As no official patch is currently available, administrators should restrict access to the affected component via network-level controls or disable the vulnerable module entirely until a vendor update is released.

Proactive Monitoring: Security teams should audit web server access logs for anomalous requests directed at /doctor/change-password.php and monitor for concurrent session tokens originating from disparate source IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block suspicious session manipulation patterns or unauthorized access attempts to the identified PHP file.

Public Exploit Available: Yes — a public proof-of-concept exists, attributed to the researcher's GitHub repository referenced in the CVE record.

Given the availability of a public proof-of-concept, the risk of exploitation is elevated. Organizations currently running PHPGurukul Car Washing Management System v1.0 must prioritize the implementation of compensating controls, such as strict IP whitelisting or disabling the vulnerable component, to mitigate the risk of session hijacking while awaiting a formal vendor security update.