CVE-2025-45953: n/a session hijacking → takeover

CISO Take

This CVE describes a session management flaw in the Change Password page of PHPGurukul Hostel Management System 2.1, a standalone PHP application for student housing administration — it has no relationship to any AI/ML component, framework, or pipeline. The 9.1 CVSS score and network/no-auth exploitability are real, but the EPSS score of 0.36% (top 72nd percentile) indicates low real-world exploitation likelihood, it is absent from CISA KEV, and no public exploit or Nuclei template exists. For an AI threat intelligence program this record carries no signal: it does not touch any tracked AI package, model, agent, or inference surface, and the `ml_ui` category tag on this record appears to be a data-quality misclassification rather than a genuine AI/ML finding. Recommended action is to deprioritize this CVE from the AI-specific feed/dashboard and route it to general web-application vulnerability management instead; if PHPGurukul Hostel Management System happens to run anywhere in the estate, the standard fix is to regenerate the session identifier on password change and invalidate prior sessions.

Sources: NVD EPSS

What is the risk?

Objectively high severity as a traditional web application vulnerability (CVSS 9.1, network vector, no privileges or user interaction required), but essentially zero relevance to AI/ML risk. There is no AI system, model, agent, or data pipeline exposed by this flaw — it is a session-handling defect in a generic PHP CRUD application. Exploitation likelihood is low (EPSS 0.36%), it is not in CISA KEV, and no weaponized exploit or scanner template is publicly available, so urgency is low even for organizations that happen to run this specific product.

How does the attack unfold?

Initial Access

Attacker reaches the unauthenticated-facing Change Password endpoint (/hostel/change-password.php) over the network.

Session Hijacking

Improper handling of session data during the password-change flow allows the attacker to hijack or reuse a valid session token.

Account Takeover

The hijacked session grants the attacker impersonation of the legitimate user within the hostel management user panel, compromising confidentiality and integrity of that account.

Initial Access

Attacker reaches the unauthenticated-facing Change Password endpoint (/hostel/change-password.php) over the network.

Session Hijacking

Improper handling of session data during the password-change flow allows the attacker to hijack or reuse a valid session token.

Account Takeover

The hijacked session grants the attacker impersonation of the legitimate user within the hostel management user panel, compromising confidentiality and integrity of that account.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n/a	—	—	No patch

Do you use n/a? You're affected.

How severe is it?

CVSS 3.1

9.1 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 35% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I High

A None

What should I do?

1 step

If this product is deployed anywhere in the environment: regenerate the session ID immediately after a successful password change, invalidate all other active sessions for that account, enforce Secure/HttpOnly/SameSite cookie attributes, apply a short idle session timeout, and monitor for concurrent sessions from differing IPs/user agents on the same account. From an AI threat intelligence operations standpoint, the corrective action is internal: review and tighten the AI-category classification heuristic so non-AI products (like generic PHP CRUD apps) stop being tagged into the ml_ui bucket, and consider excluding or relabeling this record so it does not consume CISO attention in the AI-specific feed.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable Yes

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass

Which compliance frameworks are affected?

Compliance analysis pending. Sign in for full compliance mapping when available.

Frequently Asked Questions

What is CVE-2025-45953?

This CVE describes a session management flaw in the Change Password page of PHPGurukul Hostel Management System 2.1, a standalone PHP application for student housing administration — it has no relationship to any AI/ML component, framework, or pipeline. The 9.1 CVSS score and network/no-auth exploitability are real, but the EPSS score of 0.36% (top 72nd percentile) indicates low real-world exploitation likelihood, it is absent from CISA KEV, and no public exploit or Nuclei template exists. For an AI threat intelligence program this record carries no signal: it does not touch any tracked AI package, model, agent, or inference surface, and the `ml_ui` category tag on this record appears to be a data-quality misclassification rather than a genuine AI/ML finding. Recommended action is to deprioritize this CVE from the AI-specific feed/dashboard and route it to general web-application vulnerability management instead; if PHPGurukul Hostel Management System happens to run anywhere in the estate, the standard fix is to regenerate the session identifier on password change and invalidate prior sessions.

Is CVE-2025-45953 actively exploited?

No confirmed active exploitation of CVE-2025-45953 has been reported, but organizations should still patch proactively.

How to fix CVE-2025-45953?

If this product is deployed anywhere in the environment: regenerate the session ID immediately after a successful password change, invalidate all other active sessions for that account, enforce Secure/HttpOnly/SameSite cookie attributes, apply a short idle session timeout, and monitor for concurrent sessions from differing IPs/user agents on the same account. From an AI threat intelligence operations standpoint, the corrective action is internal: review and tighten the AI-category classification heuristic so non-AI products (like generic PHP CRUD apps) stop being tagged into the `ml_ui` bucket, and consider excluding or relabeling this record so it does not consume CISO attention in the AI-specific feed.

What is the CVSS score for CVE-2025-45953?

CVE-2025-45953 has a CVSS v3.1 base score of 9.1 (CRITICAL). The EPSS exploitation probability is 0.42%.

What are the technical details?

Original Advisory

A vulnerability was found in PHPGurukul Hostel Management System 2.1 in the /hostel/change-password.php file of the user panel - Change Password component. Improper handling of session data allows a Session Hijacking attack, exploitable remotely

Exploitation Scenario

An attacker with network access to the hostel panel's Change Password endpoint exploits improper session handling to hijack an active session token — for example by predicting, fixating, or reusing a session identifier that isn't rotated after the password change — then uses that session to impersonate the legitimate user and gain unauthorized access to their account within the hostel management panel. This is a conventional web session-management attack with no AI/ML-specific component, model interaction, or agent involvement.