SQL Injection Vulnerability in Blood Bank Management System by Code Projects
CVE-2024-9986

9.8CRITICAL

Key Information:

Vendor: Code-projects
Status: Blood Bank Management System
Vendor: CVE Published:; 15 October 2024

Badges

👾 Exploit Exists🟡 Public PoC

Summary

A significant SQL injection vulnerability has been identified in version 1.0 of the Blood Bank Management System by Code Projects. The flaw resides in the handling of user inputs within the 'member_register.php' file, specifically affecting parameters such as 'fullname', 'username', 'password', and 'email'. This vulnerability enables remote attackers to execute arbitrary SQL queries through crafted input, leading to potential unauthorized access to sensitive data and database manipulation. The issue is compounded by the public disclosure of the exploit, heightening the urgency for affected users to secure their systems promptly. Although the initial advisory primarily cites the 'password' parameter as vulnerable, caution is advised as other input fields may also be compromised.

Affected Version(s)

Blood Bank Management System 1.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-9986 - Proof of Concept