Executive brief
A security vulnerability exists in the itsourcecode Online Blood Bank Management System, a web application used for managing blood donor and hospital records. An attacker can exploit this flaw to gain unauthorized access to the underlying database, potentially leading to the theft of sensitive medical or personal information. Because the flaw is easily accessible over the internet, it poses a significant risk to data privacy and system integrity.
Technical details
A SQL injection vulnerability exists in the itsourcecode Online Blood Bank Management System 1.0 within the /admin/campsdetails.php component (also referenced as /campsdetails.php). The root cause is the failure to properly sanitize or validate the 'hospital' POST parameter before using it in a database query. A remote, unauthenticated attacker can exploit this by sending specially crafted SQL payloads to perform boolean-based, error-based, or time-based blind injection. Successful exploitation allows for unauthorized database access, data extraction, and potential modification of records. A public exploit (PoC) has been released.
Affected products
- itsourcecode Online Blood Bank Management System 1.0
Timeline
- 2026-05-09: disclosed: Vulnerability details and PoC shared on GitHub.
- 2026-06-01: advisory: CVE-2026-10250 published.