CVE-2026-10249: itsourcecode Online Blood Bank Management System viewrequest.php sql injection
A vulnerability was identified in itsourcecode Online Blood Bank Management System 1.0. Impacted is an unknown function of the file /admin/viewrequest.php. Such manipulation of the argument ID leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
itsourcecode Online Blood Bank Management System 1.0from your environment.If the application or the affected module is not required, uninstall or remove the application to eliminate the vulnerable component.
- Configuration
Modify /admin/viewrequest.php so the ID parameter is validated and handled using parameterized queries (prepared statements) or appropriate input sanitization/escaping to eliminate SQL injection.
itsourcecode Online Blood Bank Management System 1.0 input_handling for /admin/viewrequest.php (ID parameter) = use prepared statements and validate/escape input - Configuration
Restrict access to /admin/viewrequest.php and the admin area to trusted IP addresses and enforce strong authentication (e.g., MFA) via web server access control or firewall rules.
Web server / network firewall access control for /admin/* = restrict to trusted IPs and require strong authentication - Compensating control
Deploy Web Application Firewall (WAF) or intrusion prevention rules to detect and block SQL injection attempts targeting the ID parameter on /admin/viewrequest.php and similar endpoints.
- Operational
Treat the system as potentially compromised: review web and application logs for suspicious requests to /admin/viewrequest.php, perform forensic investigation as needed, and rotate any credentials or secrets that may have been exposed.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10249?
The severity of CVE-2026-10249 is classified as high with a score of 7.3.
What type of vulnerability is CVE-2026-10249?
CVE-2026-10249 is an SQL Injection vulnerability affecting the itsourcecode Online Blood Bank Management System.
How do I fix CVE-2026-10249?
To fix CVE-2026-10249, ensure that input validation and parameterized queries are implemented to prevent SQL injection.
Can CVE-2026-10249 be exploited remotely?
Yes, CVE-2026-10249 can be exploited remotely through manipulation of the argument ID in the affected file.
What software is affected by CVE-2026-10249?
CVE-2026-10249 affects version 1.0 of the itsourcecode Online Blood Bank Management System.