This vulnerability affects itsourcecode Online Blood Bank Management System 1.0. An SQL injection flaw is present in an unspecified function in /admin/campsdetails.php, triggered by manipulation of the hospital parameter. The vulnerability allows remote attackers to inject SQL commands, potentially impacting the confidentiality, integrity, and availability of the backend database. The CVSS 4.0 base score is 6.9, indicating medium severity with network attack vector, low complexity, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability. No official patch or vendor advisory is currently available.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database remotely, potentially leading to unauthorized data access or modification. However, the impact is rated as medium severity with limited confidentiality, integrity, and availability impacts according to the CVSS vector. There is no evidence of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround has been published, users should monitor for vendor updates. Until a patch is available, restricting access to the vulnerable endpoint and applying web application firewall rules to detect and block SQL injection attempts may help reduce risk.