| Title | PHPGurukul Blood Donor Management System Using CodeIgniter 1.0 SQL Injection |
|---|
| Description | Blood Donor Management System Using CI V1.0 contains an unauthenticated SQL Injection vulnerability in the /admin/Report endpoint. The vulnerability exists because the authentication check in the Report controller constructor is entirely commented out, making the endpoint publicly accessible without login and form validation only checks if fromdate and todate are "required" — no date format or type validation is performed and concatenates raw POST values directly into a SQL string via $this->db->where("date(create_date) between '$fdate' and '$tdate'"). CodeIgniter's Query Builder does not escape raw string arguments to where(), so the entire string is passed to MySQL as-is. An attacker can submit an injection payload in either date field to execute arbitrary SQL queries. |
|---|
| Source | ⚠️ https://github.com/usernamevnq/CVEs/issues/2 |
|---|
| User | n4k3r0 (UID 91985) |
|---|
| Submission | 08/12/2026 10:01 (1 month ago) |
|---|
| Moderation | 09/14/2026 07:03 (1 month later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 403393 [PHPGurukul Blood Donor Management System 1.0 Report Endpoint Report.php fromdate/todate sql injection] |
|---|
| Points | 20 |
|---|