The vulnerability manifests as an SQL injection in the get_state.php handler due to unsanitized G_STATE_ID parameter. An attacker can use crafted input to alter query logic, potentially extracting, modifying, or deleting database contents. This weakness corresponds to CWE-74 and CWE-89 and could compromise the confidentiality and integrity of the blood bank database.

Affected product is BloodBank Managing System version 1.0 from code‑projects, including the get_state.php script. The vulnerability exists in an unnamed function that processes the G_STATE_ID request argument. Users running the 1.0 release are exposed; no other versions have been disclosed.

The CVSS score of 5.3 indicates a moderate threat severity, while the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. However, a publicly disclosed exploit demonstrates that remote attackers can trigger the injection simply by sending a specially crafted HTTP request containing a malicious G_STATE_ID value to the vulnerable endpoint.