Listen to this Post
The vulnerability exists in the `page=city` module of the admin panel (/admin/?page=city). The application fails to properly sanitize user-supplied input passed through the `ID` parameter. An attacker, possessing at least low-privileged admin credentials (PR:L), can inject arbitrary SQL commands into the database query. This is possible because the input is directly concatenated into the SQL statement without using prepared statements or adequate escaping. The manipulation of the `ID` argument allows the execution of read/write SQL queries, such as `UNION SELECT` statements, to extract sensitive information from the database, including administrator credentials or personally identifiable information stored within the COVID Tracking System. The attack is network-based (AV:N), requires no special access conditions (AC:L, AT:N), and no user interaction (UI:N), leading to low impacts on confidentiality, integrity, and availability (VC:L, VI:L, VA:L).
Platform: itsourcecode COVID Tracking
Version: 1.0
Vulnerability: SQL Injection
Severity: Medium
date: 2025-11-23
Prediction: 2025-12-15
What Undercode Say:
curl -s "http://target.com/admin/?page=city&ID=1'" | grep -i error sqlmap -u "http://target.com/admin/?page=city&ID=1" --risk=3 --level=5
' UNION SELECT username,password FROM administrators--
How Exploit:
1. Authenticate as low-privilege admin.
2. Navigate to `/admin/?page=city`.
3. Append SQL payload to `ID` parameter.
4. Execute query to dump database.
Protection from this CVE:
Update to patched version.
Use parameterized queries.
Implement WAF rules.
Impact:
Data confidentiality loss.
Authentication bypass potential.
System integrity compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
