CVE-2025-13568
📋 TL;DR
CVE-2025-13568 is a SQL injection vulnerability in itsourcecode COVID Tracking System 1.0 that allows remote attackers to execute arbitrary SQL commands via the ID parameter in the /admin/?page=people endpoint. This affects all deployments of this specific software version. Attackers can potentially access, modify, or delete database content.
💻 Affected Systems
- itsourcecode COVID Tracking System
📦 What is this software?
Covid Tracking System by Angeljudesuarez
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data manipulation, authentication bypass, or full system takeover via SQL injection to RCE chaining.
Likely Case
Unauthorized data access, extraction of sensitive information (patient data, admin credentials), and potential privilege escalation.
If Mitigated
Limited impact with proper input validation, parameterized queries, and WAF protection blocking malicious SQL patterns.
🎯 Exploit Status
Exploit details published on GitHub; SQL injection via ID parameter is straightforward for attackers with basic skills.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://itsourcecode.com/
Restart Required: No
Instructions:
No official patch available. Consider migrating to a supported alternative or implementing workarounds.
🔧 Temporary Workarounds
WAF Rule Implementation
allDeploy web application firewall rules to block SQL injection patterns targeting the /admin/?page=people endpoint.
Input Validation Filter
allImplement server-side input validation to sanitize the ID parameter, allowing only numeric values.
🧯 If You Can't Patch
- Isolate the system from internet access and restrict to internal network only.
- Implement strict network segmentation and monitor all traffic to the vulnerable endpoint.
🔍 How to Verify
Check if Vulnerable:
Test the /admin/?page=people endpoint with SQL injection payloads in the ID parameter (e.g., ID=1' OR '1'='1).Check Version:
Check the software version in the application interface or configuration files.Verify Fix Applied:
Verify that SQL injection attempts no longer succeed and that input validation is properly implemented.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in application logs
- Multiple requests to /admin/?page=people with suspicious ID parameters
Network Indicators:
- HTTP requests containing SQL keywords (SELECT, UNION, etc.) in the ID parameter
SIEM Query:
source="web_logs" AND uri="/admin/?page=people" AND (query_string="*SELECT*" OR query_string="*UNION*" OR query_string="*OR*1*" OR query_string="*'*" OR query_string="*--*")