CVE-2025-63535

The application does not properly sanitize user-supplied data before placing it in SQL queries. An attacker can manipulate the search field by injecting arbitrary SQL code. As a result, it is possible to bypass the authentication mechanism and gain unauthorized access to the system without knowing the correct credentials.

An attacker can bypass authentication and gain unauthorized access to the system, as well as read or modify data stored in the database (high risk to data confidentiality and integrity).

Patches available from the vendor should be applied according to the references. As an interim security measure, it is recommended to implement parameterized SQL queries (prepared statements) and validation and sanitization of input data on the server side. Until a patch is released, consider restricting access to the application only to trusted networks.

Blood Bank Management System version 1.0 (abs.php component), authored by Shridharshukl