The BloodBank Managing System 1.0 from code-projects contains a SQL injection vulnerability in the get_state.php file. Specifically, the G_STATE_ID parameter is not properly sanitized, allowing an attacker to inject malicious SQL commands. This can be exploited remotely without authentication or user interaction. The CVSS 4.0 base score is 5.3, reflecting medium severity with network attack vector, low complexity, and no privileges required. No official fix or patch has been published as of the data provided.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The vulnerability is remotely exploitable without authentication, increasing its risk. However, the CVSS score and vector indicate limited impact due to low confidentiality, integrity, and availability requirements. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the absence of an official fix, users should consider implementing input validation or parameterized queries on the G_STATE_ID parameter as a temporary mitigation. Monitor vendor channels for updates and apply official patches once available.