PT-2025-33421 · Sourcecodester · Covid19 Testing Management System

Zhuyi · Published 2025-08-14 · Updated 2025-08-20 · CVE-2025-8989

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: SourceCodester COVID 19 Testing Management System version 1.0

Description: A SQL injection issue exists due to the manipulation of the mobilenumber argument in the processing of the /edit-phlebotomist.php file. The attack can be initiated remotely, and the exploit has been publicly disclosed. Other parameters may also be affected.

Recommendations: As a temporary workaround, consider restricting access to the /edit-phlebotomist.php file until a patch is available. Sanitize the mobilenumber input to prevent SQL injection attacks. Review the code for other potentially vulnerable parameters and apply appropriate input validation and sanitization techniques.

Exploit

Fix

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2025-8989

Affected Products

Covid19 Testing Management System

References · 12

• 🔥 https://github.com/zhuyi-hz/cve/issues/2 · Exploit
• https://osv.dev/vulnerability/CVE-2025-8989 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-8989 · Security Note
• https://vuldb.com/?id.319985 · Note
• https://twitter.com/cracbot/status/1958121874744844500 · Twitter Post
• https://twitter.com/CVEnew/status/1956289055307846054 · Twitter Post
• https://t.me/CVEtracker/30063 · Telegram Post
• https://sourcecodester.com · Note
• https://twitter.com/VulmonFeeds/status/1956202394913477094 · Twitter Post
• https://t.me/cveNotify/132381 · Telegram Post
• https://vuldb.com/?submit.628676 · Note
• https://vuldb.com/?ctiid.319985 · Note