CVE-2024-10605: Blood Bank Management System CSRF Vulnerability

CVE-2024-10605 Overview

CVE-2024-10605 is a cross-site request forgery (CSRF) vulnerability in code-projects Blood Bank Management System 1.0. The flaw affects an unknown function within the /file/request.php file. Attackers can craft malicious web pages that trigger unauthorized state-changing requests when authenticated users visit them. The exploit has been publicly disclosed, increasing the likelihood of opportunistic abuse against exposed installations. The vulnerability is tracked under CWE-352: Cross-Site Request Forgery and is remotely exploitable without prior authentication of the attacker.

Critical Impact
Remote attackers can force authenticated users of the Blood Bank Management System to submit unintended requests through /file/request.php, altering application data without user consent.

Affected Products

Fabian Blood Bank Management System 1.0
Component: /file/request.php
CPE: cpe:2.3:a:fabian:blood_bank_management_system:1.0:*:*:*:*:*:*:*

Discovery Timeline

2024-11-01 - CVE-2024-10605 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10605

Vulnerability Analysis

The Blood Bank Management System handles blood donation and request workflows through PHP endpoints. The /file/request.php endpoint processes state-changing operations without validating the origin of the request. Because the application does not verify a per-session anti-CSRF token or check the Origin and Referer headers, any authenticated browser session becomes an attack surface. An attacker hosting a crafted page can cause the victim's browser to send forged requests using existing session cookies. The impact is limited to integrity of application data, with no direct confidentiality or availability consequences documented.

Root Cause

The root cause is missing CSRF protection on a state-changing HTTP endpoint. The application relies solely on ambient session credentials to authorize actions submitted to /file/request.php. It does not implement synchronizer tokens, double-submit cookies, or the SameSite cookie attribute to bind requests to a legitimate origin.

Attack Vector

Exploitation requires an authenticated user of the Blood Bank Management System to visit an attacker-controlled page while their session is active. The malicious page issues a hidden HTML form submission or JavaScript-driven request targeting /file/request.php. The victim's browser automatically attaches the session cookie, and the server processes the forged request as legitimate. A public CSRF example repository is referenced in the VulDB entry #282615 as illustrative of the technique.

No verified exploit code specific to this CVE is available; the vulnerability mechanism follows the standard CSRF pattern described in CWE-352.

Detection Methods for CVE-2024-10605

Indicators of Compromise

Unexpected POST or GET requests to /file/request.php where the Referer header points to an external domain or is absent.
Rapid or duplicate blood request submissions tied to a single authenticated session originating from unusual client contexts.
Web server access logs showing /file/request.php invocations without accompanying navigation to the request submission page.

Detection Strategies

Inspect HTTP request logs for /file/request.php and compare Origin and Referer headers against the application's canonical hostname.
Deploy a web application firewall (WAF) rule that flags cross-origin state-changing requests to Blood Bank Management System endpoints.
Correlate authenticated session activity with browser navigation events to identify requests submitted without user interaction.

Monitoring Recommendations

Enable verbose access logging on the PHP application server and forward logs to a centralized analytics platform.
Alert on submissions to /file/request.php that lack a valid CSRF token parameter once mitigations are deployed.
Track anomalous spikes in blood request records that may indicate automated forgery activity.

How to Mitigate CVE-2024-10605

Immediate Actions Required

Restrict access to the Blood Bank Management System to trusted networks or place it behind an authenticated reverse proxy until a patch is available.
Instruct users to log out of the application when not in active use to shorten the window of exploitability.
Set session cookies with the SameSite=Strict or SameSite=Lax attribute to block cross-site cookie transmission.

Patch Information

No vendor patch has been published for Fabian Blood Bank Management System 1.0 at the time of NVD publication. Refer to the Code Projects Resource Hub and VulDB CTI ID #282615 for updates. Administrators should apply source-level fixes by adding CSRF tokens to all state-changing forms and validating them server-side in /file/request.php.

Workarounds

Add a synchronizer token to every form that posts to /file/request.php and validate the token on the server before processing the request.
Enforce Origin and Referer header checks in PHP to reject requests originating from unauthorized domains.
Configure the web server to attach SameSite=Strict to the PHPSESSID cookie via session_set_cookie_params.

bash

# Configuration example: enforce SameSite on PHP session cookies
# Add to php.ini or a bootstrap file loaded before session_start()
session.cookie_samesite = "Strict"
session.cookie_secure = 1
session.cookie_httponly = 1