CVE-2025-63535 Details

A SQL injection vulnerability has been identified in the Blood Bank Management System version 1.0, specifically within the abs.php component. The vulnerability arises because the application does not properly sanitize user-supplied input in SQL queries. This oversight allows attackers to inject arbitrary SQL code. By manipulating the search field, an attacker can bypass authentication and gain unauthorized access to the system.

To address this vulnerability, all SQL queries should be revised to use parameterized statements or prepared statements with bound variables, rather than dynamic string concatenation. User input must be validated and sanitized on both the client and server sides. Additionally, implement least privilege principles for the database user, ensuring it has only the necessary permissions. Regular code reviews and penetration testing should be conducted to identify and rectify injection flaws.