CVE-2025-63531 is a Critical severity (CVSS 10.0) SQL injection in Blood Bank Management System 1.0, in receiverLogin.php. Crafted values in the remail and rpassword fields can bypass the login. The record lists no fixed version. Take the app off public networks, rewrite the login query with prepared statements, and check the project page for updates.
The weakness is CWE-89. The Gold page for the CVE is CVE-2025-63531 on Gold.
What's affected
- Blood Bank Management System 1.0, by the shridharshukl project on GitHub
- Vulnerable file: receiverLogin.php
- Vulnerable fields: remail and rpassword
- Fixed version: none listed in the record
The description says the application fails to sanitize user supplied input in its SQL queries, and that an attacker can use the two fields to bypass authentication and gain unauthorized access. The CVSS vector shows network access, low complexity, no privileges, no user interaction and a changed scope, which together produce the top score of 10.0.
This is a small PHP project that people download and run directly. There is usually no package manager entry and no automatic update channel, so the first job is finding out whether you ran it at all.
How to check if you're exposed
Search your servers for the file and for the project directory name:
find /var/www -type f -name "receiverLogin.php" 2>/dev/null
If it exists, read how the login query is assembled:
grep -n "remail\|rpassword" receiverLogin.php
grep -n "SELECT" receiverLogin.php
If the two form values are placed into the SQL string by concatenation, the code matches the pattern in the record. Review web server logs for the login page as general hygiene. The record gives no indicators of compromise, so a clean log review does not prove the system was untouched.
What to do now
- Take the application off the public internet or put it behind a VPN or IP allowlist now.
- Check the project repository for a newer commit. The record names no fixed version, so do not assume one exists.
- Rewrite the login query in receiverLogin.php with prepared statements and bound parameters. Compare the password in code against a stored hash instead of placing it in the query.
- Review every other file that queries the database for the same pattern.
- Limit the database account the app uses to the rights it needs.
- If the system holds real donor or recipient data, treat a possible exposure as a privacy matter and involve whoever owns that duty in your organisation.
- Use the free in-browser dependency scan on other projects you run, and look up related records in the Gold directory.
Try it yourself
Click through it at your own pace, or open it full screen.
Why it matters
The flaw is a classic injection: input is allowed to change the meaning of a database command. When that happens in a login query, the check that decides who gets in can be altered by the person trying to get in. The fix is also classic. Use parameterized queries so the database always treats form values as data.
Nothing in the record says this CVE is exploited in the wild, and it is not marked as listed in the CISA Known Exploited Vulnerabilities catalog. The score comes from the CVE record, and the sources are a researcher write up and the project repository, not a vendor advisory. A medical themed sample app is a reminder to check where downloaded demo software has quietly ended up in production.
Quick check
Does this CVE have a fix?
The record lists no fixed version. Check the project repository, and fix the query in receiverLogin.php yourself if you maintain the code.
Is it exploited in the wild?
The record does not mark it as known exploited. It does describe an authentication bypass, so prioritise it if the app is reachable from the internet.
Sources
References listed in the CVE record (not independently fetched for this review):
- https://drive.google.com/file/d/12yeOXW_sN69QjsQtW0_k9AGqozi1s0di/view?usp=sharing
- https://github.com/Shridharshukl/Blood-Bank-Management-System
- https://github.com/kiwi865/CVEs/blob/main/CVE-2025-63531.md
Last reviewed: 18 October 2026.
