Executive brief
The Blood System application, a web-based platform for managing blood bank records, contains a security flaw that allows attackers to inject malicious scripts. By submitting a specially crafted city name during the donation registration process, an attacker can execute code in the browsers of other users, such as administrators or staff members. This could lead to the theft of login sessions, unauthorized access to sensitive medical donor data, or the defacement of the application's user profiles.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in code-projects Blood System 1.0. The vulnerability is located in the 'city' POST parameter within the /don.php component. The application fails to properly sanitize this input before storing it in the database. When the stored data is subsequently retrieved and rendered in profile.php (or bbms.php), the malicious script executes in the context of the victim's browser. An unauthenticated attacker can exploit this by submitting a donation form with a payload such as <script>alert('xss')</script> in the city field, potentially leading to session hijacking or unauthorized actions on behalf of authenticated users.
Affected products
- code-projects Blood System 1.0
Timeline
- 2025-08-11: disclosed: Vulnerability discovered and exploit details documented by TaintRadar researchers.
- 2026-07-30: advisory: CVE-2025-65342 published by NVD/MITRE.