Authentication Bypass in PHPGurukul Blood Donor Management System

A critical authentication vulnerability has been identified in the PHPGurukul Blood Donor Management System version 1.0. The flaw resides within the __construct function of the admin controller located at /application/controllers/admin/Dashboard.php. By manipulating this function, a remote, unauthenticated attacker can circumvent the application's authentication logic to access administrative functions. The vulnerability is publicly disclosed, and proof-of-concept exploit code is currently available, increasing the risk of opportunistic exploitation by malicious actors. Organizations utilizing this system should restrict external access to the administrative dashboard or transition to a secure alternative, as no vendor-provided patch has been documented.

Impact

Successful exploitation of this vulnerability allows unauthorized actors to bypass authentication to the administrative panel. This can result in full administrative control over the Blood Donor Management System, potentially leading to unauthorized data exfiltration, database manipulation, or the compromise of sensitive donor and patient information managed by the platform.

Recommendation

• Restrict network access to the admin dashboard interface to trusted management IP ranges via firewall rules.
• Implement web application firewall (WAF) rules to filter suspicious requests targeting /application/controllers/admin/Dashboard.php.
• Evaluate the necessity of the Blood Donor Management System 1.0 installation; given the lack of patching, consider decommissioning or replacing the system.
• Monitor web server access logs for anomalous, unauthenticated requests targeting administrative URI paths.