PT-2025-35777 · Unknown · Corona Virus Tracker App India

Aninda + 1 · Published 2025-09-03 · Updated 2025-09-08 · CVE-2025-56608

Positive Technologies (AI Summary)

CVSS v3.1

4.2

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Corona Virus Tracker App India version 1.0

Description The Android application uses MD5 for digest authentication. The handleDigest() function utilizes MessageDigest.getInstance("MD5") to hash credentials. MD5 is a cryptographic algorithm susceptible to hash collisions, potentially enabling replay, spoofing, or brute-force attacks, which could lead to unauthorized access.

Recommendations version 1.0: Replace MD5 with a stronger cryptographic hash function for authentication. Consider using SHA-256 or a similar modern algorithm.

Exploit

Fix

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

CVE-2025-56608

Affected Products

Corona Virus Tracker App India

References · 7

• 🔥 https://github.com/anonaninda/Aninda-security-advisories/blob/main/CVE-2025-56608.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-56608 · Security Note
• https://osv.dev/vulnerability/CVE-2025-56608 · Vendor Advisory
• https://github.com/MobSF/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#identifying-insecure-andor-deprecated-cryptographic-algorithms-mstg-crypto-4 · Note
• https://t.me/cveNotify/134664 · Telegram Post
• https://twitter.com/CVEnew/status/1963275355021619316 · Twitter Post
• https://sourcecodester.com/android/14292/android-corona-virus-tracker-app-india-using-b4a.html · Note