CVE-2025-63525

An attacker who has an active user session (of any level) can send a crafted HTTP request to the delete.php file. This request bypasses proper privilege verification (CWE-284 — improper access control), allowing execution of operations reserved for higher-privileged accounts. The error results from a lack of proper identity validation and privilege level verification on the server side before executing sensitive actions.

An authenticated attacker can perform unauthorized data deletion operations and other actions reserved for administrators, which may lead to violations of integrity and confidentiality of data stored in the blood bank management system.

Patches available from the vendor should be applied according to the references. As a temporary measure, it is recommended to restrict application access only to trusted, authorized users and to monitor requests directed to the delete.php file for unauthorized calls.

Blood Bank Management System version 1.0 by Shridharshukl