Description
A vulnerability was identified in itsourcecode Online Blood Bank Management System 1.0. Impacted is an unknown function of the file /admin/viewrequest.php. Such manipulation of the argument ID leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used.
Published: 2026-06-01
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw exists in itsourcecode Online Blood Bank Management System 1.0, specifically within the /admin/viewrequest.php file. An attacker can manipulate the ID parameter to inject arbitrary SQL statements, allowing unauthorized access to the underlying database and the potential to view, modify, or delete sensitive patient records. This is a classic SQL Injection vulnerability, characterized by CWE-89 and involving unsanitized input to the database engine (CWE-74).

Affected Systems

The vulnerability affects the itsourcecode Online Blood Bank Management System version 1.0. No other versions or patches were documented in the advisory, so this release is the confirmed target.

Risk and Exploitability

The CVSS score of 6.9 indicates moderate risk. The EPSS score is not available, but public proof‑of‑concept code has been released, suggesting that attackers can exploit the flaw remotely through the web interface. The vulnerability is not listed in CISA's KEV catalog. The likely attack path involves sending a crafted request to the /admin/viewrequest.php endpoint with a malicious ID value; the attacker does not need elevated privileges beyond web access, though an authenticated admin session would enhance the impact.

Generated by OpenCVE AI on June 1, 2026 at 12:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply a vendor patch or upgrade to a version of the Online Blood Bank Management System that addresses the SQL injection in viewrequest.php.
  • If a patch is not yet available, modify viewrequest.php to use prepared statements or parameterized queries and validate that the ID argument is a numeric value before inclusion in any SQL command.
  • Restrict the /admin/viewrequest.php endpoint to authenticated users with appropriate administrative privileges, ensuring that unauthenticated or non‑admin access is denied.
  • Temporarily block public access to the /admin/viewrequest.php page through firewall or web server rules until a code fix or patch is applied.

Generated by OpenCVE AI on June 1, 2026 at 12:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 01 Jun 2026 11:00:00 +0000

Type Values Removed Values Added
Description A vulnerability was identified in itsourcecode Online Blood Bank Management System 1.0. Impacted is an unknown function of the file /admin/viewrequest.php. Such manipulation of the argument ID leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used.
Title itsourcecode Online Blood Bank Management System viewrequest.php sql injection
First Time appeared Itsourcecode
Itsourcecode online Blood Bank Management System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:itsourcecode:online_blood_bank_management_system:*:*:*:*:*:*:*:*
Vendors & Products Itsourcecode
Itsourcecode online Blood Bank Management System
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Itsourcecode Online Blood Bank Management System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-06-01T10:30:08.257Z

Reserved: 2026-05-31T10:16:21.663Z

Link: CVE-2026-10249

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-06-01T11:16:24.260

Modified: 2026-06-01T13:14:43.470

Link: CVE-2026-10249

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-01T13:00:12Z

Weaknesses