CVE-2025-2033
Published: 06 March 2025
Summary
CVE-2025-2033 is a medium-severity Injection (CWE-74) vulnerability in Code-Projects Blood Bank Management System. Its CVSS base score is 6.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 15.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents SQL injection by validating and sanitizing the manipulable donor_id parameter in view_donor.php.
Requires timely identification, reporting, and remediation of the SQL injection flaw through patching or code correction.
Enables detection of the SQL injection vulnerability in Blood Bank Management System 1.0 via automated vulnerability scanning.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing web app (/user_dashboard/view_donor.php) enables exploitation of public-facing application (T1190), server software component abuse (T1505 per advisory), and data collection from databases (T1213.006) via arbitrary SQL queries.
NVD Description
A vulnerability, which was classified as critical, was found in code-projects Blood Bank Management System 1.0. Affected is an unknown function of the file /user_dashboard/view_donor.php. The manipulation of the argument donor_id leads to sql injection. It is possible to launch…
more
the attack remotely. The exploit has been disclosed to the public and may be used.
Deeper analysisAI
CVE-2025-2033 is a critical SQL injection vulnerability in code-projects Blood Bank Management System 1.0. The issue affects an unknown function within the file /user_dashboard/view_donor.php, where the donor_id argument can be manipulated to trigger the injection. It is remotely exploitable and has been assigned a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), with associated CWEs CWE-74 (Improper Neutralization of Special Elements used in an SQL Command) and CWE-89 (SQL Injection).
An attacker with low privileges (PR:L), such as an authenticated user, can exploit this vulnerability remotely with little complexity (AC:L) and no user interaction (UI:N). Successful exploitation allows limited impacts on confidentiality, integrity, and availability (C:L/I:L/A:L), potentially enabling unauthorized data access, modification, or disruption within the application's database.
Advisories and details are available via VulDB entries (ctiid.298776, id.298776) and a submit reference (submit.512164), along with the project site at code-projects.org. A public exploit disclosure exists in a GitHub repository at github.com/intercpt/XSS1/blob/main/SQL.md, indicating the attack may be readily usable.
The exploit has been publicly disclosed, increasing the risk of active exploitation against unpatched instances of Blood Bank Management System 1.0.
Details
- CWE(s)