Roobes

**Name of the Vulnerable Software and Affected Versions** itsourcecode Vehicle Management System version 1.0 **Description** A critical issue has been found in the itsourcecode Vehicle Management System, affecting some unknown functionality of the file mybill.php. The manipulation of the `id` argument leads to SQL injection. This issue can be exploited remotely. **Recommendations** For itsourcecode Vehicle Management System version 1.0, consider disabling the `id` argument in the mybill.php file as a temporary workaround to minimize the risk of SQL injection exploitation. Restrict access to the mybill.php file to minimize the risk of remote attacks. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** itsourcecode Online Blood Bank Management System version 1.0 **Description** A critical issue was found in the itsourcecode Online Blood Bank Management System, affecting an unknown functionality of the file massage.php. The manipulation of the `bid` argument leads to SQL injection. This issue can be exploited remotely. **Recommendations** For itsourcecode Online Blood Bank Management System version 1.0, consider restricting access to the massage.php file until a patch is available. As a temporary workaround, avoid using the `bid` argument in the affected file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** itsourcecode Online Blood Bank Management System version 1.0 **Description** A critical issue affects some unknown functionality of the file changepwd.php. The manipulation of the `useremail` argument leads to sql injection. The attack may be launched remotely. **Recommendations** For itsourcecode Online Blood Bank Management System version 1.0, consider disabling the `changepwd.php` file or restricting access to it until a patch is available. Avoid using the `useremail` argument in the affected functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.