vendor:
Blood Bank
by:
Ersin Erenler
4.1
CVSS
MEDIUM
SQL Injection
89
CWE
Product Name: Blood Bank
Affected Version From: 1
Affected Version To: 1
Patch Exists: NO
Related CWE: CVE-2023-46014, CVE-2023-46017, CVE-2023-46018
CPE: a:code-projects:blood_bank:1.0
Platforms Tested: Windows, Linux
2023
Blood Bank v1.0 SQL Injection Vulnerability
The vulnerability exists in Blood Bank v1.0 due to insufficient input validation on 'hemail' and 'hpassword' parameters. This allows attackers to execute SQL injection attacks, bypass authentication, and unauthorized access the database. The affected file is /hospitalLogin.php.
Mitigation:
To mitigate this vulnerability, implement proper input validation and sanitization techniques, use parameterized queries or ORM libraries, and regularly update the software to the latest secure version.
