CVE-2025-45949: n/a session hijack

CISO Take

This CVE describes a session hijacking flaw in the change-password component of PHPGurukul's User Registration & Login and User Management System V3.3, a generic PHP web application template — not an AI/ML product, framework, or library. Despite the CVSS 9.8 rating (network-exploitable, no privileges, no user interaction), the EPSS score of 0.425% is very low, there is no public exploit or Nuclei scanner template, and it is not in the CISA KEV catalog, indicating minimal real-world exploitation activity to date. The 'ml_ui' AI category tag on this record appears to be a misclassification, since nothing in the description, references, or affected product ties it to an AI/ML pipeline, model-serving stack, or any package in our tracked AI/ML inventory. For CISOs: confirm PHPGurukul is not embedded anywhere in your AI/ML tooling stack (highly unlikely) before allocating remediation effort, and treat this as a routine generic-web-app finding rather than an AI-security priority.

Sources: NVD EPSS CISA KEV

What is the risk?

Technically high-severity by CVSS (9.8, AV:N/AC:L/PR:N/UI:N, full C/I/A impact) due to unauthenticated, network-exploitable session mishandling, but real-world exploitation likelihood is low: EPSS is 0.425% (near the bottom of the scoring range despite the percentile framing), no public PoC or exploit code is referenced beyond a single GitHub CVE writeup, no Nuclei template exists, and CISA has not flagged it for KEV. The vulnerability targets a niche, low-adoption open-source PHP admin template rather than a widely deployed framework or AI/ML dependency, further limiting blast radius across most organizations' environments.

How does the attack unfold?

Entry Point

Attacker sends a crafted request to the unauthenticated change-password.php endpoint of the user panel.

Session Manipulation

Improper session data handling allows the attacker to hijack or reuse a valid session identifier.

Account Takeover

Attacker gains full access to the victim's account with complete confidentiality, integrity, and availability impact.

Entry Point

Attacker sends a crafted request to the unauthenticated change-password.php endpoint of the user panel.

Session Manipulation

Improper session data handling allows the attacker to hijack or reuse a valid session identifier.

Account Takeover

Attacker gains full access to the victim's account with complete confidentiality, integrity, and availability impact.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n/a	—	—	No patch

Do you use n/a? You're affected.

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 41% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I High

A High

What should I do?

1 step

For organizations that do run PHPGurukul software: regenerate session identifiers on password change, invalidate all other active sessions for the account, enforce HttpOnly/Secure/SameSite cookie attributes, and monitor for session token reuse across IPs/user-agents. No PHPGurukul-issued patch is referenced in the available data — check the vendor repository for an updated release. For AI/ML-focused security teams: verify this software is not present in your stack (expected outcome: not applicable) and deprioritize relative to genuine AI/ML supply-chain findings.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable Yes

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Framework

Which compliance frameworks are affected?

Compliance analysis pending. Sign in for full compliance mapping when available.

Frequently Asked Questions

What is CVE-2025-45949?

This CVE describes a session hijacking flaw in the change-password component of PHPGurukul's User Registration & Login and User Management System V3.3, a generic PHP web application template — not an AI/ML product, framework, or library. Despite the CVSS 9.8 rating (network-exploitable, no privileges, no user interaction), the EPSS score of 0.425% is very low, there is no public exploit or Nuclei scanner template, and it is not in the CISA KEV catalog, indicating minimal real-world exploitation activity to date. The 'ml_ui' AI category tag on this record appears to be a misclassification, since nothing in the description, references, or affected product ties it to an AI/ML pipeline, model-serving stack, or any package in our tracked AI/ML inventory. For CISOs: confirm PHPGurukul is not embedded anywhere in your AI/ML tooling stack (highly unlikely) before allocating remediation effort, and treat this as a routine generic-web-app finding rather than an AI-security priority.

Is CVE-2025-45949 actively exploited?

No confirmed active exploitation of CVE-2025-45949 has been reported, but organizations should still patch proactively.

How to fix CVE-2025-45949?

For organizations that do run PHPGurukul software: regenerate session identifiers on password change, invalidate all other active sessions for the account, enforce HttpOnly/Secure/SameSite cookie attributes, and monitor for session token reuse across IPs/user-agents. No PHPGurukul-issued patch is referenced in the available data — check the vendor repository for an updated release. For AI/ML-focused security teams: verify this software is not present in your stack (expected outcome: not applicable) and deprioritize relative to genuine AI/ML supply-chain findings.

What is the CVSS score for CVE-2025-45949?

CVE-2025-45949 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 0.50%.

What are the technical details?

Original Advisory

A critical vulnerability was found in PHPGurukul User Registration & Login and User Management System V3.3 in the /loginsystem/change-password.php file of the user panel - Change Password component. Improper handling of session data allows a Session Hijacking attack, exploitable remotely and leading to account takeover.

Exploitation Scenario

An unauthenticated attacker interacts with the change-password.php endpoint and exploits improper session data handling to obtain or replay a valid session token, hijacking the victim's authenticated session and taking over their account — a standard web session-management flaw with no AI/ML-specific attack surface (no prompt injection, model manipulation, or inference API abuse involved).