Cyber Posture

CVE-2025-63532

Critical

Published: 01 December 2025

Published
01 December 2025
Modified
04 December 2025
KEV Added
Patch
CVSS Score 9.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
EPSS Score 0.0008 23.4th percentile
Risk Priority 19 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

Security Summary

CVE-2025-63532 is a SQL injection vulnerability (CWE-89) affecting Blood Bank Management System 1.0, specifically within the cancel.php component. Published on 2025-12-01T16:15:55.800, it carries a CVSS v3.1 base score of 9.6 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N). The vulnerability arises because the application does not properly sanitize user-supplied input in SQL queries, enabling attackers to inject arbitrary SQL code through manipulation of the search field.

An attacker with low privileges (PR:L) can exploit this vulnerability remotely over the network (AV:N) with low attack complexity (AC:L) and without requiring user interaction (UI:N). Successful exploitation alters the scope (S:C) and results in high impacts to confidentiality (C:H) and integrity (I:H), with no availability impact (A:N). By injecting SQL via the search field, the attacker can bypass authentication mechanisms and gain unauthorized access to the system.

Advisories and additional details are available in the provided references, including a Google Drive document at https://drive.google.com/file/d/12yeOXW_sN69QjsQtW0_k9AGqozi1s0di/view?usp=sharing, the Blood Bank Management System GitHub repository at https://github.com/Shridharshukl/Blood-Bank-Management-System, and a CVE-specific page at https://github.com/kiwi865/CVEs/blob/main/CVE-2025-63532.md.

Details

CWE(s)
CWE-89

Affected Products

shridharshukl
blood bank management system
1.0

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

SQL injection vulnerability in the web application's cancel.php allows bypassing authentication and unauthorized access by exploiting a public-facing application.

References