PT-2025-33416 · Sourcecodester · Covid19 Testing Management System

Zhuyi · Published 2025-08-14 · Updated 2025-08-15 · CVE-2025-8985

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: SourceCodester COVID 19 Testing Management System version 1.0

Description: A SQL injection issue exists in an unknown functionality of the file /profile.php. Manipulation of the mobilenumber argument can lead to SQL injection, allowing for remote attacks. The exploit has been publicly disclosed and may be used. Other parameters might also be affected.

Recommendations: As a temporary workaround, consider restricting access to the /profile.php file until a fix is available. Sanitize the mobilenumber parameter to prevent SQL injection attacks. Review and sanitize all other parameters used in the /profile.php file to identify and address potential SQL injection vulnerabilities.

Exploit

Fix

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2025-8985

Affected Products

Covid19 Testing Management System

References · 10

• 🔥 https://github.com/zhuyi-hz/cve/issues/6 · Exploit
• https://osv.dev/vulnerability/CVE-2025-8985 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-8985 · Security Note
• https://t.me/CVEtracker/30058 · Telegram Post
• https://vuldb.com/?ctiid.319981 · Note
• https://vuldb.com/?id.319981 · Note
• https://t.me/cveNotify/132374 · Telegram Post
• https://sourcecodester.com · Note
• https://twitter.com/CVEnew/status/1956289060311589050 · Twitter Post
• https://vuldb.com/?submit.628662 · Note