CVE-2025-13567: COVID Tracking System SQL Injection Flaw

CVE-2025-13567 Overview

CVE-2025-13567 is a SQL injection vulnerability in itsourcecode COVID Tracking System 1.0. The flaw resides in the /admin/?page=establishment endpoint, where the ID parameter is passed directly to a backend SQL query without proper sanitization. An authenticated remote attacker with low privileges can manipulate the ID argument to inject arbitrary SQL statements. The exploit details have been disclosed publicly, increasing the likelihood of opportunistic attack attempts against exposed instances.

The vulnerability is tracked under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) and CWE-74 (Injection).

Critical Impact
Authenticated remote attackers can extract, modify, or delete records stored in the COVID Tracking System database by injecting SQL through the ID parameter on the establishment administration page.

Affected Products

itsourcecode COVID Tracking System 1.0
angeljudesuarez covid_tracking_system 1.0
All deployments exposing /admin/?page=establishment

Discovery Timeline

2025-11-23 - CVE-2025-13567 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-13567

Vulnerability Analysis

The vulnerability exists in the establishment management page of the itsourcecode COVID Tracking System web application. When an administrator browses to /admin/?page=establishment, the application accepts an ID request parameter and incorporates it into a SQL query string without parameterization or escaping. This is a textbook SQL injection pattern that allows attackers to break out of the query context and append arbitrary SQL clauses.

Because the application is a PHP-based open-source project distributed by itsourcecode, deployments commonly expose this admin interface over the public internet. A successful injection can disclose database schema details, dump user credentials, alter establishment records, or pivot to authentication bypass through UNION-based or boolean-based extraction techniques.

The issue is classified under CWE-89 for SQL injection and CWE-74 for the broader injection category.

Root Cause

The root cause is the direct concatenation of untrusted user input from the ID GET parameter into a SQL statement. The application does not use prepared statements, parameter binding, or input validation routines on the ID value before passing it to the MySQL backend.

Attack Vector

Exploitation requires network access to the admin endpoint and a low-privileged authenticated session. The attacker sends a crafted HTTP GET request to /admin/?page=establishment&id=<payload>, where <payload> contains SQL syntax such as UNION SELECT or time-based blind injection primitives. Public exploit details are referenced in the GitHub Issue Discussion and VulDB entry #333331.

The vulnerability mechanism follows the standard injection pattern where unsanitized input from the ID parameter is concatenated into a SELECT statement against the establishment table. No verified proof-of-concept code is mirrored here; refer to the linked VulDB and GitHub references for technical reproduction details.

Detection Methods for CVE-2025-13567

Indicators of Compromise

HTTP requests to /admin/?page=establishment containing SQL meta-characters such as single quotes, UNION SELECT, SLEEP(, --, or /* in the ID parameter
Web server access logs showing repeated requests to the establishment page with varying ID values from a single source IP
Database error messages or HTTP 500 responses returned in conjunction with malformed ID values
Unexpected outbound traffic from the database host correlated with admin page activity

Detection Strategies

Deploy web application firewall rules that flag SQL keywords and tautology patterns in query string parameters targeting /admin/
Enable verbose MySQL query logging on COVID Tracking System databases and alert on queries referencing system tables such as information_schema.tables or mysql.user
Correlate authentication events with subsequent injection attempts to identify compromised admin accounts

Monitoring Recommendations

Continuously monitor admin endpoint access patterns for anomalies in request rate, payload length, and parameter entropy
Track failed login attempts followed by successful admin sessions accessing the establishment page
Forward web server, application, and database logs to a centralized analytics platform for cross-source correlation and retention

How to Mitigate CVE-2025-13567

Immediate Actions Required

Restrict access to /admin/ paths to trusted IP ranges or behind a VPN until a patch is applied
Rotate all administrator credentials and review user accounts for unauthorized additions
Audit the database for unexpected schema changes, new privileged users, or data exfiltration evidence
Deploy WAF signatures that block SQL injection payloads targeting the ID parameter

Patch Information

No official vendor patch has been published by itsourcecode or the upstream author angeljudesuarez at the time of this writing. Organizations running the COVID Tracking System 1.0 should treat the application as unmaintained and either decommission it or implement compensating controls. Track updates at the VulDB advisory and the vendor source for any forthcoming fix.

Workarounds

Modify the source of establishment.php to use parameterized queries with PDO or mysqli_prepare() instead of string concatenation
Add server-side input validation that enforces a numeric type cast on the ID parameter, for example intval($_GET['id'])
Place the application behind an authenticating reverse proxy that strips or rejects suspicious query string content
Consider migrating to an actively maintained equivalent application if continued use is required

bash

# Example Nginx rule to reject non-numeric ID parameters on the establishment page
location /admin/ {
    if ($arg_page = "establishment") {
        if ($arg_id !~ "^[0-9]+$") {
            return 403;
        }
    }
    proxy_pass http://covid_tracking_backend;
}