CVE-2026-10249
Description
SQL injection in itsourcecode Online Blood Bank Management System 1.0 via the id parameter in /admin/viewrequest.php allows unauthenticated remote attackers to execute arbitrary SQL commands.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
SQL injection in itsourcecode Online Blood Bank Management System 1.0 via the `id` parameter in `/admin/viewrequest.php` allows unauthenticated remote attackers to execute arbitrary SQL commands.
Vulnerability
A SQL injection vulnerability exists in itsourcecode Online Blood Bank Management System version 1.0. The flaw resides in the /admin/viewrequest.php file, where the id parameter is directly concatenated into SQL queries without proper sanitization or parameterization [2]. This allows an attacker to inject malicious SQL code via the id parameter. The software is available from itsourcecode.com [1].
Exploitation
The attack can be executed remotely without authentication [2]. An attacker sends a crafted GET request to /Blood-Bank-Management-System-in-Php-with-Source-Code/bloodbank/admin/viewrequest.php?id=. The provided proof-of-concept uses id=2 but can be modified to include SQL injection payloads [2]. No special privileges or user interaction is required.
Impact
Successful exploitation allows an attacker to achieve unauthorized database access, retrieve sensitive data, modify or delete data, and potentially gain comprehensive system control [2]. This can lead to data leakage, data tampering, and service interruption, posing a serious threat to system security and business continuity.
Mitigation
As of the publication date, no official patch has been released. The vendor (itsourcecode) has not provided a fixed version. Users should apply input validation and parameterized queries to the id parameter in /admin/viewrequest.php. If the application is no longer maintained, consider replacing it with a secure alternative. The vulnerability is publicly known and may be exploited.
AI Insight generated on Jun 1, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
1- Range: =1.0
Patches
0No patches discovered yet.
Vulnerability mechanics
Root cause
"Missing input validation and sanitization of the 'id' parameter in /admin/viewrequest.php allows direct injection of malicious SQL code into database queries."
Attack vector
An unauthenticated attacker sends a crafted GET request to `/admin/viewrequest.php` with a malicious `id` parameter [ref_id=1]. No login or authorization is required to exploit this vulnerability [ref_id=1]. The attacker can use boolean-based blind, error-based, or time-based blind SQL injection techniques to extract database contents, as demonstrated by sqlmap payloads such as `id=2' AND EXTRACTVALUE(3934,CONCAT(0x5c,0x717a717a71,(SELECT (ELT(3934=3934,1))),0x7178717871))-- HeSm` [ref_id=1].
Affected code
The vulnerable file is `/admin/viewrequest.php` in the Online Blood Bank Management System V1.0 [ref_id=1]. The `id` parameter is taken from the GET request and used directly in SQL queries without sanitization or validation [ref_id=1].
What the fix does
The advisory recommends using prepared statements and parameter binding to separate SQL code from user input, strict input validation and filtering, minimizing database user permissions, and conducting regular security audits [ref_id=1]. No patch has been published by the vendor at the time of this report [ref_id=1].
Preconditions
- authNo authentication required; the endpoint is publicly accessible
- networkAttacker must be able to send HTTP GET requests to the server
- inputThe 'id' GET parameter is accepted without sanitization
Reproduction
Send a GET request to `/Blood-Bank-Management-System-in-Php-with-Source-Code/bloodbank/admin/viewrequest.php?id=2` with a SQL injection payload in the `id` parameter. For example, using sqlmap: `python sqlmap.py -r a.txt --random-agent --dbs` where `a.txt` contains the raw HTTP request with the vulnerable URL [ref_id=1]. The advisory confirms boolean-based blind, error-based, and time-based blind injection types are all exploitable [ref_id=1].
Generated on Jun 1, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
6News mentions
0No linked articles in our index yet.