Cyber Resilience

CVE-2025-50491

High

Published: 28 July 2025

Published
28 July 2025
Modified
29 July 2025
KEV Added
Patch
CVSS Score v3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
EPSS Score 0.0018 39.8th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-50491 is a high-severity Insufficient Session Expiration (CWE-613) vulnerability in Phpgurukul Bank Locker Management System. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 39.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

Improper session invalidation in the component /banker/change-password.php of PHPGurukul Bank Locker Management System v1 allows attackers to execute a session hijacking attack.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1539 Steal Web Session Cookie Credential Access
An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials.
Why these techniques?

CVE enables session hijacking via improper session invalidation in a public-facing web application (/banker/change-password.php), facilitating T1190 (Exploit Public-Facing Application) and T1539 (Steal Web Session Cookie) by allowing stolen sessions to persist post-password change.

Affected Assets

phpgurukul
bank locker management system
1.0

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-613

Locks the device (typically after inactivity) until re-authentication, addressing insufficient session expiration by preventing indefinite access.

addresses: CWE-613

Automatically terminating sessions after a defined period directly enforces session expiration, preventing indefinite session lifetimes that attackers can exploit.

addresses: CWE-613

Re-authentication after inactivity or time-based triggers prevents indefinite use of potentially hijacked or stale sessions.

addresses: CWE-613

Terminating sessions and network connections upon completion prevents insufficient session expiration.

addresses: CWE-613

Directly enforces termination of network sessions after inactivity or end-of-session, preventing indefinite session lifetime.

addresses: CWE-613

Consistent clocks across systems allow session expiration and timeout enforcement to function as intended in distributed environments.

addresses: CWE-613

When the non-persistent artifact is a session or connection, mandatory termination implements the missing expiration that CWE-613 describes.

addresses: CWE-613

Timed refresh of session-related information or on-demand generation plus deletion implements proper session expiration.

References