CVE-2025-13567
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
A vulnerability was detected in itsourcecode COVID Tracking System 1.0 affecting an unknown function of the file /admin/?page=establishment. Manipulation of the ID argument results in SQL injection.
Risk Assessment
An attacker can remotely execute arbitrary SQL queries, potentially leading to data leakage, modification, or deletion. The exploit is publicly available.
Recommendation
Apply input validation and parameterized SQL queries, and consider updating or replacing the vulnerable system.
Other vulnerabilities in COVID Tracking System
See all- CVE-2025-13570Medium
A vulnerability in COVID Tracking System 1.0 affects the /admin/?page=state file. Manipulation of the ID argument leads to SQL injection. The attack can be initiated remotely, and the exploit has been made public.
- CVE-2025-13569Medium
A vulnerability in COVID Tracking System 1.0 affects the /admin/?page=city file. Manipulation of the ID argument leads to SQL injection. The attack can be launched remotely, and the exploit has been disclosed.
- CVE-2025-13568Medium
A vulnerability in COVID Tracking System 1.0 affects the /admin/?page=people file. Manipulation of the ID argument leads to SQL injection. The attack can be initiated remotely, and the exploit has been published.
Original NVD description (English source)
A vulnerability was detected in itsourcecode COVID Tracking System 1.0. This affects an unknown function of the file /admin/?page=establishment. The manipulation of the argument ID results in sql injection. It is possible to launch the attack remotely. The exploit is now public and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS