Online Blood Bank Management System CVE-2026-10249

Exploitation requires network reachability to the /admin/viewrequest.php endpoint of an Online Blood Bank Management System 1.0 deployment and the ability to supply the 'ID' parameter - per CVSS AV:N/AC:L/PR:N/UI:N, no authentication or user interaction is required against default configurations. The limiting factor is that the vulnerable endpoint lives under /admin/, so deployments that gate the admin directory behind external authentication (HTTP basic auth, VPN, IP allowlist) or that are not internet-exposed materially reduce realistic exposure. The publicly available exploit (GitHub issues link in references) lowers the skill barrier, and because this is a small PHP application typically self-hosted by educational/small-org users, instances are often left with default permissive configurations.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N indicates network-reachable, low-complexity, unauthenticated exploitation with no user interaction - a high-priority profile for an internet-exposed app. However, scope is unchanged and impacts are Low across C/I/A (suggesting partial data exposure rather than full DB compromise via this single vector), which is why the base score lands at 7.3 rather than critical. The 'E:P' temporal metric and the referenced GitHub issue confirm publicly available exploit code exists, increasing real-world risk. No EPSS score or CISA KEV entry was supplied, and the product is a small open-source/educational PHP application with likely limited but exposed deployment footprint - meaning targeted opportunistic scanning is plausible but mass exploitation campaigns are less certain. Despite the 'Low' impact ratings, SQL injection in an admin endpoint typically enables credential extraction and lateral escalation beyond what CVSS captures, so defenders should treat this as higher risk than the numeric score suggests.

An unauthenticated remote attacker discovers an exposed Online Blood Bank Management System instance via Shodan or Google dorking, then issues a crafted HTTP request such as GET /admin/viewrequest.php?ID=1' UNION SELECT username,password FROM admin-- to enumerate administrator credentials from the backend database. Because publicly available exploit code (referenced in the GitHub issue at zhengdexu-bot/zhengdexu#1) automates this pattern, even low-skill attackers can extract donor PII, blood-type records, and admin login hashes. With credentials in hand the attacker pivots to the admin panel for full application takeover.