CVE-2025-13570
📋 TL;DR
This CVE describes a SQL injection vulnerability in the itsourcecode COVID Tracking System 1.0. Attackers can exploit this by manipulating the ID parameter in the /admin/?page=state endpoint to execute arbitrary SQL commands. Organizations using this specific COVID tracking system are affected.
💻 Affected Systems
- itsourcecode COVID Tracking System
📦 What is this software?
Covid Tracking System by Angeljudesuarez
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, and potential system takeover via SQL injection leading to remote code execution.
Likely Case
Unauthorized access to sensitive COVID tracking data, potential data exfiltration, and database manipulation.
If Mitigated
Limited impact with proper input validation, parameterized queries, and network segmentation in place.
🎯 Exploit Status
Exploit details are publicly available on GitHub, making this easily exploitable by attackers with basic SQL injection knowledge.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://itsourcecode.com/
Restart Required: No
Instructions:
No official patch available. Consider implementing parameterized queries and input validation in the source code.
🔧 Temporary Workarounds
Web Application Firewall (WAF)
allDeploy a WAF with SQL injection rules to block malicious requests
Input Validation
allImplement strict input validation for the ID parameter to only accept expected values
🧯 If You Can't Patch
- Isolate the COVID Tracking System from the internet and restrict access to authorized users only
- Implement network segmentation to limit database access from the web application server
🔍 How to Verify
Check if Vulnerable:
Test the /admin/?page=state endpoint with SQL injection payloads in the ID parameterCheck Version:
Check the application version in the admin panel or configuration filesVerify Fix Applied:
Verify that SQL injection attempts no longer succeed and proper error handling is in place📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in application logs
- Multiple failed login attempts from single IP
- Suspicious parameter values in access logs
Network Indicators:
- SQL injection patterns in HTTP requests to /admin/?page=state
- Unusual database connection patterns
SIEM Query:
source="web_logs" AND uri="/admin/?page=state" AND (param="ID" AND value MATCHES "[';]|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|CREATE")