CVE-2025-50489 describes an improper session invalidation vulnerability in PHPGurukul Student Result Management System v2.0, specifically in the /srms/change-password.php component. This vulnerability enables attackers to hijack user sessions by exploiting the failure to properly invalidate sessions during password changes. The CVSS 3.1 base score is 7.5, indicating high severity, with network attack vector, low attack complexity, no privileges required, no user interaction, and an impact limited to availability. No official patch or fix has been disclosed as of the publication date.

Successful exploitation of this vulnerability can lead to session hijacking, allowing attackers to maintain or gain unauthorized access to user sessions. The CVSS vector indicates no confidentiality or integrity impact but a high impact on availability. This could disrupt service or user access within the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing additional session management controls such as manual session invalidation after password changes and monitoring for suspicious session activity.