CVE-2026-90841: PHPGurukul Blood Donor Management System Report Endpoint Report.php sql injection
A security flaw has been discovered in PHPGurukul Blood Donor Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /application/controllers/admin/Report.php of the component Report Endpoint. The manipulation of the argument fromdate/todate results in sql injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update the Report.php endpoint to validate/parse fromdate and todate as expected date types and ensure database queries use prepared statements/parameterized queries for fromdate and todate to prevent SQL injection.
PHPGurukul Blood Donor Management System (Report Endpoint) /application/controllers/admin/Report.php fromdate and todate input handling = Use parameterized queries (prepared statements) for fromdate/todate and do not build SQL strings directly from user input
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The issue can be exploited remotely with no privileges or user interaction required. An attacker would target the Report endpoint and manipulate the fromdate or todate argument.
Which deployments are known to be affected?
PHPGurukul Blood Donor Management System version 1.0 is identified as affected. The vulnerable functionality is in /application/controllers/admin/Report.php.
How mature is exploitation?
A public exploit has been released and may be used in attacks. This makes internet-accessible instances a practical exposure concern.