CVE-2025-2390: Blood Bank Management System SQLi Vulnerability

CVE-2025-2390 Overview

CVE-2025-2390 is a SQL injection vulnerability in code-projects Blood Bank Management System 1.0. The flaw resides in the /user_dashboard/add_donor.php endpoint, where unsanitized user input is passed directly into a database query. Authenticated remote attackers can manipulate the vulnerable parameter to inject arbitrary SQL statements. The exploit has been publicly disclosed, increasing the likelihood of opportunistic attacks against exposed instances. The weakness is classified under CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component.

Critical Impact
Authenticated attackers can inject arbitrary SQL through add_donor.php, exposing donor records and potentially compromising the integrity of the underlying MySQL database.

Affected Products

code-projects Blood Bank Management System 1.0
Deployments referencing cpe:2.3:a:code-projects:blood_bank_management_system:1.0
Any downstream fork inheriting the vulnerable add_donor.php handler

Discovery Timeline

2025-03-17 - CVE-2025-2390 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-2390

Vulnerability Analysis

The vulnerability is a SQL injection flaw in the donor registration workflow of the Blood Bank Management System. The /user_dashboard/add_donor.php script accepts user-supplied form data and concatenates it into a SQL statement without parameterization or input sanitization. A remote attacker with low-privilege user access can submit crafted input that alters the query structure. Successful exploitation allows extraction of donor records, credential material, and other database contents. Depending on database privileges, the attacker may also modify or delete records within the application schema. The public disclosure of exploit details lowers the barrier for automated scanning and exploitation.

Root Cause

The root cause is improper neutralization of special elements passed to the SQL interpreter [CWE-74]. The add_donor.php handler builds queries through string concatenation and lacks prepared statements or escaping routines. Any request parameter that flows into the donor insertion query is attacker-controllable.

Attack Vector

Exploitation occurs over the network against the application's user dashboard. The attacker must hold a low-privilege authenticated session, then submit a manipulated request to /user_dashboard/add_donor.php. Standard SQL injection techniques including UNION-based extraction, boolean-based blind injection, and time-based blind injection are applicable. Refer to the GitHub SQL8 research document and VulDB entry #299889 for disclosure details.

Detection Methods for CVE-2025-2390

Indicators of Compromise

HTTP POST requests to /user_dashboard/add_donor.php containing SQL metacharacters such as ', --, UNION, SLEEP(, or INFORMATION_SCHEMA.
Web server logs showing abnormally long response times to add_donor.php consistent with time-based blind SQL injection.
Unexpected new rows or modifications in donor-related database tables originating from low-privilege accounts.
MySQL error strings surfaced in application responses referencing donor insertion queries.

Detection Strategies

Deploy web application firewall rules that flag SQL metacharacters and tautology patterns on requests to add_donor.php.
Enable MySQL general query logging and alert on UNION SELECT, information_schema access, or BENCHMARK/SLEEP calls from the application user.
Correlate authenticated session identifiers with anomalous request volume against the donor endpoint.

Monitoring Recommendations

Baseline normal request patterns to /user_dashboard/add_donor.php and alert on deviations in payload length or parameter entropy.
Forward web and database logs to a centralized analytics platform for cross-source correlation of injection attempts.
Monitor outbound database connections from the web tier for unexpected data volume that may indicate mass extraction.

How to Mitigate CVE-2025-2390

Immediate Actions Required

Restrict network access to the Blood Bank Management System until a fix is deployed, allowing only trusted IP ranges.
Disable or gate the add_donor.php workflow behind additional authorization checks for non-administrator users.
Rotate database credentials and audit the donor tables for unauthorized modifications.
Review authentication logs and revoke suspicious low-privilege user accounts created recently.

Patch Information

No official vendor patch is listed in the enriched advisory data. Consult the code-projects resource hub and VulDB entry #299889 for updates. Operators should apply source-level fixes by replacing concatenated SQL with parameterized queries using PHP Data Objects (PDO) or mysqli prepared statements, and by validating all inputs against strict allow-lists.

Workarounds

Front the application with a web application firewall configured to block common SQL injection signatures on donor endpoints.
Enforce least-privilege database accounts so the web application cannot read or alter tables outside its functional scope.
Add server-side input validation for donor form fields to reject non-alphanumeric characters where inappropriate.

bash

# Example hardening: restrict MySQL account privileges used by the app
REVOKE ALL PRIVILEGES ON blood_bank.* FROM 'bbms_app'@'%';
GRANT SELECT, INSERT, UPDATE ON blood_bank.donors TO 'bbms_app'@'%';
FLUSH PRIVILEGES;