CVE-2025-13569: COVID Tracking System SQLi Vulnerability

CVE-2025-13569 Overview

CVE-2025-13569 is a SQL injection vulnerability in itsourcecode COVID Tracking System 1.0. The flaw resides in the /admin/?page=city endpoint, where the ID parameter is passed directly into a database query without sanitization. Attackers with low-privileged authenticated access can manipulate the parameter to inject arbitrary SQL statements. The exploit has been publicly disclosed, increasing the risk of opportunistic exploitation against exposed installations. The vulnerability is tracked under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) and CWE-74 (Improper Neutralization in Output).

Critical Impact
Remote authenticated attackers can read, modify, or delete database records by injecting SQL payloads into the ID parameter of the city administration page.

Affected Products

itsourcecode COVID Tracking System 1.0
angeljudesuarez covid_tracking_system 1.0
Deployments exposing /admin/?page=city to untrusted users

Discovery Timeline

2025-11-23 - CVE-2025-13569 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-13569

Vulnerability Analysis

The vulnerability exists in the administrative city management page of the COVID Tracking System. The application accepts an ID parameter through the URL /admin/?page=city and concatenates the value directly into an SQL statement. No parameterization, prepared statements, or input validation are applied before query execution.

This classification falls under SQL Injection (CWE-89). An authenticated attacker can break out of the intended query context and append clauses such as UNION SELECT, OR 1=1, or stacked queries depending on the underlying database driver. Successful exploitation exposes the full content of the application database, including administrative credentials and patient tracking data.

The vulnerability is remotely exploitable over the network and requires only low privileges. According to the EPSS model, the probability of observed exploitation is currently low, but public disclosure of the exploit raises the practical risk for internet-facing installations.

Root Cause

The root cause is the unsafe construction of SQL queries using user-supplied input. The ID parameter is interpolated into the SQL string without binding or escaping. The application also fails to enforce strict type validation, allowing non-numeric payloads to reach the query layer.

Attack Vector

An attacker authenticates to the admin interface, then submits a crafted request such as /admin/?page=city&id=<payload>. The injected payload is executed by the database engine, returning data through error messages, boolean responses, or UNION-based extraction. Refer to the GitHub Issue Discussion and VulDB entry #333333 for the public proof-of-concept details.

Detection Methods for CVE-2025-13569

Indicators of Compromise

HTTP requests to /admin/?page=city containing SQL meta-characters such as ', ", --, UNION, SELECT, or SLEEP(
Unexpected 500-series responses or database error strings returned from the city administration page
Anomalous SELECT activity in MySQL logs originating from the application service account during admin sessions
New or modified administrative records in the city or users tables without corresponding application activity

Detection Strategies

Deploy web application firewall signatures that flag SQL injection patterns targeting the id query string parameter
Enable database query logging and alert on queries containing tautologies, comment terminators, or stacked statements
Correlate admin authentication events with subsequent malformed requests to identify low-privileged accounts probing the endpoint

Monitoring Recommendations

Capture and retain HTTP access logs for the /admin/ path with full query strings for forensic review
Monitor outbound database connections from the web tier for unusual volume or sensitive table access
Alert on authentication anomalies that precede suspicious city-page requests, such as logins from new geolocations

How to Mitigate CVE-2025-13569

Immediate Actions Required

Restrict access to /admin/ using network controls, VPN gating, or IP allow-listing until a patch is applied
Audit the users and city tables for unauthorized changes and rotate all administrative credentials
Review web server and database logs for prior exploitation attempts referencing the id parameter

Patch Information

No official vendor patch is listed in the NVD references for CVE-2025-13569. Operators of the itsourcecode COVID Tracking System 1.0 should track upstream sources such as itsourcecode.com for updates. In the absence of a vendor fix, refactor the affected query to use parameterized statements with PDO or mysqli_prepare, and cast the ID parameter to an integer before query execution.

Workarounds

Apply a server-side input filter that rejects non-numeric values for the id parameter on /admin/?page=city
Configure the application database account with least-privilege roles to limit data exposure from successful injection
Deploy a web application firewall rule blocking SQL meta-characters in query parameters destined for the admin interface

bash

# Example ModSecurity rule to block SQLi payloads on the affected endpoint
SecRule REQUEST_URI "@beginsWith /admin/" \
    "chain,deny,status:403,id:1013569,msg:'CVE-2025-13569 SQLi attempt'"
  SecRule ARGS:id "@rx (?i)(union|select|sleep\(|--|';|\bor\b\s+1=1)" "t:none"