CVE-2025-63531 | A SQL injection vulnerability exists in the Blood Bank Manag… | CVSS 10.0 CRITICAL

Description

A SQL injection vulnerability exists in the Blood Bank Management System 1.0 within the receiverLogin.php component. The application fails to properly sanitize user-supplied input in SQL queries, allowing an attacker to inject arbitrary SQL code. By manipulating the remail and rpassword fields, an attacker can bypass authentication and gain unauthorized access to the system.

Metadata

CVE ID: CVE-2025-63531
State: PUBLISHED
Assigner: mitre
Reserved: 2025-10-27 00:00 UTC
Published: 2025-12-01 00:00 UTC
Last updated: 2025-12-01 18:30 UTC
Primary CWE: CWE-89
CWE-89 Improper Neutralization of Special Elements used in a…
Vendor / Product: n/a / n/a
Sources: cve.org · NVD

Severity & Metrics

10.0 CRITICAL CVSS 3.1

CVSS:3.1/AC:L/AV:N/A:N/C:H/I:H/PR:N/S:C/UI:N

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: yes
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
n/a	n/a	—	n/a

Weakness (CWE)

CWE	Source	Description
—	cna	n/a
CWE-89	adp	CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSS scores (1)

Score	Severity	Version	Source	Vector
10.0	CRITICAL	3.1	cna	CVSS:3.1/AC:L/AV:N/A:N/C:H/I:H/PR:N/S:C/UI:N

References (3)