A critical SQL injection vulnerability in the Simple Blood Donor Management System 1.0 allows unauthenticated remote attackers to manipulate database queries and potentially gain full system control.

This is a SQL injection vulnerability (CWE-89) located in the editedcampaign.php file. The application fails to sanitize the campaignname parameter before incorporating it into database queries, allowing an unauthenticated attacker to inject malicious SQL commands.

Successful exploitation of this vulnerability poses a severe risk to the confidentiality, integrity, and availability of the system. An attacker can perform unauthorized database operations, including data exfiltration, modification, or deletion, which could lead to a total compromise of the application and its underlying data. With a CVSS score of 7.3, this flaw represents a significant risk to business continuity and data protection standards.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the affected system or take the application offline until code-level mitigations are implemented.

Proactive Monitoring: Monitor web server logs for suspicious POST requests containing SQL syntax or unusual characters, particularly targeting the editedcampaign.php endpoint.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the campaignname parameter.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub issue linked by the research write-up.

Given the availability of a public proof-of-concept and the lack of a vendor-provided patch, this vulnerability presents an immediate risk to any deployment of the Simple Blood Donor Management System. Organizations must treat this as a high-priority issue and apply strict input validation or transition to a more secure management solution immediately to prevent unauthorized database access.