CVE-2025-2390
📋 TL;DR
A critical SQL injection vulnerability in Blood Bank Management System 1.0 allows attackers to execute arbitrary SQL commands via the /user_dashboard/add_donor.php endpoint. This can lead to unauthorized data access, modification, or deletion. Organizations using this software are affected.
💻 Affected Systems
- code-projects Blood Bank Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including donor medical records, authentication bypass, and potential remote code execution on the database server.
Likely Case
Unauthorized access to sensitive donor information, data exfiltration, and potential manipulation of blood bank records.
If Mitigated
Limited impact with proper input validation and database permissions, potentially only error messages exposed.
🎯 Exploit Status
Exploit details are publicly available on GitHub. The vulnerability requires no authentication and has simple exploitation vectors.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://code-projects.org/
Restart Required: No
Instructions:
No official patch available. Consider implementing manual fixes or migrating to alternative software.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement parameterized queries and input validation for all user inputs in add_donor.php
Modify PHP code to use prepared statements: $stmt = $conn->prepare('INSERT INTO donors (name, blood_type) VALUES (?, ?)'); $stmt->bind_param('ss', $name, $blood_type);
Web Application Firewall Rules
allBlock SQL injection patterns targeting the vulnerable endpoint
Add WAF rule: deny requests to /user_dashboard/add_donor.php containing SQL keywords like UNION, SELECT, INSERT, DROP
🧯 If You Can't Patch
- Restrict network access to the application using firewall rules to only trusted IP addresses
- Implement database-level controls: use least privilege accounts, enable logging of all database queries
🔍 How to Verify
Check if Vulnerable:
Test the /user_dashboard/add_donor.php endpoint with SQL injection payloads like ' OR '1'='1 in form parametersCheck Version:
Check the software version in the application interface or configuration filesVerify Fix Applied:
Verify that SQL injection attempts return error messages or are blocked, and that parameterized queries are implemented📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts or parameter manipulation in web server logs
Network Indicators:
- HTTP requests to /user_dashboard/add_donor.php containing SQL keywords
- Unusual outbound database connections
SIEM Query:
source="web_server" AND uri="/user_dashboard/add_donor.php" AND (request_body CONTAINS "UNION" OR request_body CONTAINS "SELECT" OR request_body CONTAINS "INSERT")