The Simple Blood Donor Management System 1.0 contains a critical SQL injection vulnerability that allows unauthenticated remote attackers to compromise database integrity.

This is a SQL injection vulnerability (CWE-89) located in the editcampaignform.php file. The application fails to properly sanitize the ID parameter, enabling unauthenticated remote attackers to inject malicious SQL commands.

Successful exploitation of this vulnerability can lead to unauthorized access to sensitive blood donor data and potential database manipulation. Given the CVSS score of 7.3, this represents a significant risk to data confidentiality and integrity, which may result in severe reputational damage and regulatory non-compliance for organizations managing donor health records.

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the application or take the system offline until a secure version is released. If the application must remain online, input validation and parameterization must be implemented manually within the editcampaignform.php source code.

Proactive Monitoring: Security teams should review web server access logs for anomalous requests containing SQL syntax patterns targeting the editcampaignform.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the vulnerable ID parameter.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the research write-up at https://github.com/kyxh001/CVE/issues/1.

The presence of a public proof-of-concept significantly increases the risk of opportunistic attacks against this software. Organizations currently running version 1.0 of the Simple Blood Donor Management System must prioritize compensating controls or service suspension to mitigate the risk of data exfiltration until a formal vendor patch is developed and verified.