CVE-2025-63535
Published: 01 December 2025
Summary
CVE-2025-63535 is a critical-severity SQL Injection (CWE-89) vulnerability in Shridharshukl Blood Bank Management System. Its CVSS base score is 9.6 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 24.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-63535 is a SQL injection vulnerability (CWE-89) in Blood Bank Management System 1.0, affecting the abs.php component. The application fails to properly sanitize user-supplied input within SQL queries, permitting attackers to inject arbitrary SQL code by manipulating the search field. Published on 2025-12-01, it carries a CVSS v3.1 base score of 9.6 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).
An attacker requires low privileges (PR:L) to exploit this remotely over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N). Exploitation changes the scope (S:C) and enables bypassing authentication to gain unauthorized system access, resulting in high confidentiality (C:H) and integrity (I:H) impacts but no availability disruption (A:N).
Advisories and additional details, including potential mitigations or patches, are documented in the provided references: a Google Drive file at https://drive.google.com/file/d/12yeOXW_sN69QjsQtW0_k9AGqozi1s0di/view?usp=sharing, the project repository at https://github.com/Shridharshukl/Blood-Bank-Management-System, and a CVE summary at https://github.com/kiwi865/CVEs/blob/main/CVE-2025-63535.md.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-199989
Vulnerability details
A SQL injection vulnerability exists in the Blood Bank Management System 1.0 within the abs.php component. The application fails to properly sanitize usersupplied input in SQL queries, allowing an attacker to inject arbitrary SQL code. By manipulating the search field,…
more
an attacker can bypass authentication and gain unauthorized access to the system.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection vulnerability in a public-facing web application (Blood Bank Management System) enables authentication bypass and unauthorized access via exploitation of remote services.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 mandates validation and sanitization of user-supplied inputs like the search field, directly preventing SQL injection by rejecting or neutralizing malicious SQL code.
SI-2 requires timely identification, reporting, and correction of flaws such as this SQL injection vulnerability through patching the abs.php component.
SC-7 implements boundary protection like web application firewalls to monitor and block SQL injection payloads in network traffic targeting the vulnerable search field.