CVE-2025-3306
📋 TL;DR
This critical SQL injection vulnerability in Blood Bank Management System 1.0 allows remote attackers to execute arbitrary SQL commands via the 'fullname' parameter in /don.php. Attackers can potentially access, modify, or delete sensitive blood bank data including donor information, medical records, and system credentials. All organizations using this specific version are affected.
💻 Affected Systems
- Blood Bank Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, system takeover via credential extraction, and potential lateral movement to connected systems.
Likely Case
Unauthorized access to sensitive donor medical information, modification of blood inventory records, and potential extraction of administrative credentials.
If Mitigated
Limited impact with proper input validation, parameterized queries, and network segmentation preventing database access.
🎯 Exploit Status
Exploit details are publicly available on GitHub. SQL injection via the 'fullname' parameter is straightforward with common SQL injection techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://code-projects.org/
Restart Required: No
Instructions:
1. Check vendor website for updates 2. If no patch available, implement workarounds 3. Consider migrating to alternative software
🔧 Temporary Workarounds
Web Application Firewall (WAF)
allDeploy WAF rules to block SQL injection patterns targeting /don.php
Input Validation Filter
allImplement server-side input validation for the fullname parameter
🧯 If You Can't Patch
- Immediately restrict network access to the application using firewall rules
- Implement database-level protections: restrict application database user permissions, enable logging of all database queries
🔍 How to Verify
Check if Vulnerable:
Test /don.php endpoint with SQL injection payloads in the fullname parameter (e.g., ' OR '1'='1)Check Version:
Check application version in admin panel or configuration filesVerify Fix Applied:
Verify that SQL injection attempts no longer succeed and return appropriate error messages📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts following SQL injection patterns
- Access to /don.php with suspicious parameters
Network Indicators:
- HTTP requests to /don.php containing SQL keywords (UNION, SELECT, INSERT, etc.)
- Abnormal database connection patterns from web server
SIEM Query:
source="web_logs" AND uri="/don.php" AND (fullname="*OR*" OR fullname="*UNION*" OR fullname="*SELECT*")