CVE-2025-10118
📋 TL;DR
This CVE describes a SQL injection vulnerability in the itsourcecode E-Logbook with Health Monitoring System for COVID-19 1.0. Attackers can exploit this by manipulating the Username parameter in the /login.php file to execute arbitrary SQL commands. Organizations using this specific software version are affected.
💻 Affected Systems
- itsourcecode E-Logbook with Health Monitoring System for COVID-19
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, authentication bypass, or system takeover
Likely Case
Unauthorized data access, credential theft, and potential privilege escalation
If Mitigated
Limited impact with proper input validation and database permissions
🎯 Exploit Status
Exploit is publicly available and requires no authentication
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://itsourcecode.com/
Restart Required: No
Instructions:
No official patch available. Consider alternative solutions or implement workarounds.
🔧 Temporary Workarounds
Web Application Firewall (WAF)
allDeploy a WAF with SQL injection rules to block malicious requests
Input Validation
allImplement server-side input validation for the Username parameter
🧯 If You Can't Patch
- Isolate the system from the internet and restrict access to trusted networks only
- Implement strict database permissions and monitor for unusual SQL queries
🔍 How to Verify
Check if Vulnerable:
Test the /login.php endpoint with SQL injection payloads in the Username parameterCheck Version:
Check software version in admin panel or configuration filesVerify Fix Applied:
Verify that SQL injection attempts no longer succeed and proper input validation is in place📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts with SQL syntax
Network Indicators:
- HTTP requests to /login.php with SQL payloads in parameters
SIEM Query:
source="web_logs" AND uri="/login.php" AND (param="Username" AND value CONTAINS "' OR " OR "--" OR "#")