CVE-2025-14667
📋 TL;DR
CVE-2025-14667 is a SQL injection vulnerability in itsourcecode COVID Tracking System 1.0 that allows remote attackers to execute arbitrary SQL commands via the meta_value parameter in the /admin/?page=system_info endpoint. This can lead to data theft, modification, or deletion. Organizations using this specific software version are affected.
💻 Affected Systems
- itsourcecode COVID Tracking System
📦 What is this software?
Covid Tracking System by Angeljudesuarez
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including exfiltration of sensitive COVID tracking data, administrative credential theft, and potential system takeover via subsequent attacks.
Likely Case
Unauthorized access to database contents, including personal health information and system configuration data.
If Mitigated
Limited impact with proper input validation, parameterized queries, and network segmentation in place.
🎯 Exploit Status
Public exploit available on GitHub. Attack can be performed remotely without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://itsourcecode.com/
Restart Required: No
Instructions:
No official patch available. Consider migrating to alternative software or implementing workarounds.
🔧 Temporary Workarounds
Web Application Firewall (WAF)
allDeploy a WAF with SQL injection rules to block malicious requests to the vulnerable endpoint.
Network Access Control
linuxRestrict access to the /admin endpoint to trusted IP addresses only.
iptables -A INPUT -p tcp --dport 80 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s TRUSTED_IP -j ACCEPT
🧯 If You Can't Patch
- Isolate the COVID Tracking System on a segmented network with strict firewall rules.
- Implement database monitoring to detect unusual SQL query patterns and unauthorized access attempts.
🔍 How to Verify
Check if Vulnerable:
Check if the system is running itsourcecode COVID Tracking System version 1.0 and has the /admin/?page=system_info endpoint accessible.Check Version:
Check application documentation or configuration files for version information.Verify Fix Applied:
Test the vulnerable endpoint with SQL injection payloads to confirm they are blocked or properly sanitized.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in application logs
- Multiple failed login attempts followed by SQL injection patterns
- Requests to /admin/?page=system_info with SQL keywords in parameters
Network Indicators:
- HTTP requests containing SQL injection payloads targeting the vulnerable endpoint
- Unusual database query patterns from the application server
SIEM Query:
source="web_logs" AND (url="/admin/?page=system_info" AND (param="meta_value" AND value CONTAINS "UNION" OR value CONTAINS "SELECT" OR value CONTAINS "' OR '1'='1"))