CVE-2025-8987

Vulnerability

Description

CVE-2025-8987 is a SQL injection vulnerability in the SourceCodester COVID 19 Testing Management System version 1.0. The flaw exists in the /test-details.php file, where the MULTIPART remark parameter is directly incorporated into SQL queries without proper sanitization or validation. This allows an attacker to inject malicious SQL code by manipulating the remark parameter[1].

Exploitation

The vulnerability can be triggered remotely without requiring authentication.[1] The provided proof-of-concept demonstrates a time-based blind SQL injection technique using MySQL's SLEEP function. An attacker can send a crafted POST request with a malicious remark parameter to exploit the vulnerability, enabling them to infer information from the database based on response timing.

Impact

Successful exploitation can lead to unauthorized access to the database, potentially allowing extraction of sensitive data, modification or deletion of records, and in severe cases, full system control. The vendor has not released a patch, and a public exploit is available, increasing the risk of active attacks.

Mitigation

No official patch or workaround has been released by the vendor. Users should consider restricting network access to the application and applying input validation or upgrading to a secure version if available.