PT-2025-18962 · Unknown · Sourcecodester Simple To-Do List System

Zonesec · Published 2025-05-04 · Updated 2025-05-04 · CVE-2025-4248

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SourceCodester Simple To-Do List System version 1.0

Description A critical vulnerability has been found in the SourceCodester Simple To-Do List System, affecting an unknown functionality of the file /complete task.php. The manipulation of the ID argument leads to SQL injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Recommendations For SourceCodester Simple To-Do List System version 1.0, consider disabling access to the /complete task.php file until a patch is available. As a temporary workaround, restrict the manipulation of the ID argument to prevent SQL injection attacks.

Exploit

Fix

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2025-4248

Affected Products

Sourcecodester Simple To-Do List System

References · 11

• 🔥 https://github.com/zonesec0/findcve/issues/9 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-4248 · Security Note
• https://osv.dev/vulnerability/CVE-2025-4248 · Vendor Advisory
• https://vuldb.com/?submit.562700 · Note
• https://t.me/cvedetector/24417 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1918918276849062158 · Twitter Post
• https://t.me/cvetracker/23006 · Telegram Post
• https://vuldb.com/?id.307345 · Note
• https://sourcecodester.com · Note
• https://vuldb.com/?ctiid.307345 · Note
• https://t.me/cvenotify/120745 · Telegram Post