CVE-2025-45949

The vulnerability (CWE-384) results from improper session data management in the password change component, located in the /loginsystem/change-password.php file. An attacker can remotely, without authentication and without user interaction, abuse the session mechanism in such a way as to gain access to another user's session. This leads to full account takeover.

An attacker can hijack the account of any user in the system, gaining full access to their data and user panel functions. Due to the network vector and lack of requirements for permissions or victim interaction, the attack is particularly dangerous.

Patches available from the vendor should be applied according to references. It is recommended to monitor the vendor's official repository (phpgurukul.com) to download the updated software version and implement secure session management mechanisms (including session identifier regeneration after password change).

PHPGurukul User Registration & Login and User Management System version V3.3