Online Blood Bank Management System CVE-2026-10250

The target must be running itsourcecode Online Blood Bank Management System 1.0 with the /admin/campsdetails.php endpoint network-reachable to the attacker. The CVSS vector states no authentication is required (PR:N), but the /admin/ path strongly implies an authentication layer should be present - defenders should verify whether their deployment actually exposes this endpoint unauthenticated or whether valid admin credentials are needed in practice. No user interaction, special client software, or non-default configuration is required beyond a standard deployment of the vulnerable PHP application backed by a MySQL/MariaDB database. Limiting factors are the niche nature of the product (small install base typical of itsourcecode educational PHP projects) and the fact that exploitation impact is bounded by what the database user account can access.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N indicates network-reachable, low-complexity exploitation with no privileges or user interaction required, supporting the 7.3 base score. The C:L/I:L/A:L impact metrics reflect that injection occurs in an admin-facing endpoint with limited per-component damage, though SQLi often enables full database compromise in practice. Exploit maturity (E:P) and report confidence (RC:R) indicate a proof-of-concept exists and the report is reasonable rather than fully confirmed. The endpoint sits under /admin/, which would typically suggest authentication is required, but the CVSS vector explicitly states PR:N - this is a notable conflict between the path naming and the scored privileges, and defenders should verify whether the admin panel actually enforces authentication or is reachable unauthenticated. EPSS and KEV data are not provided, so no quantitative exploitation probability or confirmed in-the-wild activity is available.

An attacker sends a crafted HTTP request to /admin/campsdetails.php with a malicious payload in the 'hospital' parameter (e.g., hospital=1' UNION SELECT username,password FROM admin-- -) to extract administrator credentials or donor PII from the backend MySQL database. Because publicly available exploit code exists on GitHub, low-skill attackers can copy and adapt the PoC without independent vulnerability research. If the admin panel is indeed reachable without authentication as the CVSS PR:N rating suggests, the attack can be fully automated against internet-exposed deployments.