CVE-2025-63532

The application does not perform proper sanitization of user-supplied input data before including it in SQL queries. An attacker can manipulate the search field in the cancel.php component by injecting arbitrary SQL code. This results in the ability to bypass the authentication mechanism (auth bypass) and gain unauthorized access to the system without knowing valid login credentials.

An attacker with network access to the application can bypass authentication and gain unauthorized access to the blood bank management system, as well as read or modify data stored in the database.

Apply patches available from the vendor according to the references. Until the fix is implemented, it is recommended to restrict access to the application only from trusted networks and implement WAF rules blocking characteristic SQL injection sequences in input fields.

Blood Bank Management System version 1.0 (Shridharshukl)