An unauthenticated SQL injection vulnerability in the Simple Blood Donor Management System 1.0 poses a critical risk of unauthorized database access and potential system compromise.

This is a SQL injection vulnerability (CWE-89) located in the /simpleblooddonor/editeddonor.php file. An unauthenticated attacker can supply malicious input via the name parameter during a POST request to execute arbitrary SQL queries against the backend database.

Successful exploitation of this vulnerability allows an attacker to bypass authentication mechanisms to query, modify, or delete sensitive donor records. Given the CVSS score of 7.3, this flaw presents a high risk to data confidentiality and integrity, potentially leading to unauthorized disclosure of personally identifiable information and complete loss of control over the application database.

Immediate Action: As no official vendor patch is available, administrators must restrict access to the /simpleblooddonor/ directory via network-level controls or disable the application until a secure version is released.

Proactive Monitoring: Monitor web server access logs for anomalous POST requests to /simpleblooddonor/editeddonor.php, particularly those containing SQL syntax characters such as single quotes, RLIKE, or SLEEP commands.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns in HTTP POST parameters.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the GitHub issue referenced by the vulnerability record.

Due to the lack of an official patch and the availability of public proof-of-concept code, this vulnerability should be treated with high urgency. Organizations using this software must implement immediate network-level restrictions or WAF-based mitigations to prevent unauthenticated database access until the vendor provides a secure update.