A stored cross-site scripting vulnerability in Blood Bank Management System 1.0 presents a significant risk to user session security and data integrity.

This vulnerability is a cross-site scripting flaw located in the login.php component. The application fails to sanitize the msg and error parameters, allowing any authenticated user to inject malicious JavaScript that executes in the context of a victim's browser.

The exploitation of this vulnerability can lead to session hijacking, unauthorized actions performed on behalf of users, or the theft of sensitive session tokens. With a CVSS score of 8.5, this high-severity flaw represents a substantial threat to organizational data security and user privacy. Successful exploitation could compromise administrative accounts, leading to unauthorized access to blood inventory management and patient data.

Immediate Action: As no official patch is currently available, administrators should restrict access to the affected login interface via network-level controls until a vendor-supplied update is released.

Proactive Monitoring: Security teams should monitor web server access logs for anomalous strings containing script tags or encoded payloads within the msg and error parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block malicious script injections targeting the identified parameters in login.php.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the researcher's GitHub repository.

Given the presence of a public proof-of-concept and the high CVSS score, this vulnerability poses a credible risk to the integrity of the Blood Bank Management System. Organizations should prioritize identifying all instances of this software and implement strict access controls or WAF protections immediately to prevent potential exploitation while awaiting a permanent vendor patch.