CVE-2025-3971 is a high severity SQL injection flaw (CVSS 7.3) in COVID19 Testing Management System 1.0 from PHPGurukul. Input reaches a database query unsafely through the empid parameter of /add-phlebotomist.php. The record says the exploit is public and lists no fixed version, so restrict access now and fix the query code yourself.
What's affected
The record names one product and one version: COVID19 Testing Management System 1.0. The weak spot is the empid parameter of /add-phlebotomist.php.
The CVSS vector says the attack runs over the network, with low complexity, no privileges and no user interaction. In plain terms, anyone who can reach the application over the network can try it without logging in.
The record states that the exploit has been disclosed to the public and may be used. It does not name a fixed release. I could not confirm a patched version from the sources listed in the record, so check the vendor site for an update before you assume one exists.
How to check if you're exposed
This is a source code application, so there is no package manager version to query. Start with where it is deployed and how it is reached.
- Find the deployment. Search your servers and repositories for the project folder and for the file add-phlebotomist.php.
- Confirm the version. The record covers 1.0.
- Open the file and look at how the empid value reaches the query. Anything built by joining strings into the SQL text is a finding.
- Check web server and database logs for requests to the page and for SQL errors, which can show earlier probing.
grep -rn "empid" /var/www/html --include=add-phlebotomist.php
Adjust the path to your web root. A hit only tells you where to read; it does not prove the code is safe or unsafe.
If you run many small web apps and are not sure which ones are internet facing, an external DAST scan of your own sites will list them. Our free in-browser dependency scan covers the libraries a project ships, which is a useful second check, but it will not find a flaw in an application's own code like this one.
What to do now
- Take the application off the public internet, or put it behind a VPN, an allow list or single sign on, until the code is fixed.
- Change the affected query to use prepared statements with bound parameters. Do the same for every other query in the file, since the record says other parameters may be affected.
- Run the database account the application uses with the minimum rights it needs. It should not own the schema or hold file or administrative privileges.
- Check the vendor or project page for a newer release and read its notes before upgrading. If none exists, plan to replace the application or maintain your own patched copy.
- Review logs from before your change for odd requests and database errors, and rotate any credentials stored in the application database if you see signs of abuse.
A web application firewall rule can reduce noise while you work, but it does not fix the query. Treat it as a stopgap only.
Why it matters
The weaknesses are SQL injection (CWE-89) and its parent, improper neutralization of special elements in output used by a downstream component (CWE-74). A value from the user becomes part of the database command, so the person sending it can change what the command does.
This product is a small management system, the kind that is often deployed once and then forgotten. With no privileges, the record rates confidentiality, integrity and availability impact as low each, which is why the score sits at 7.3 rather than higher. Small scores still matter when the data behind them is personal.
This CVE is not on the CISA Known Exploited Vulnerabilities list. That is not a reason to wait, because the record says exploit details are public.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is there a patched version I can install?
No. The record lists COVID19 Testing Management System 1.0 as affected and names no fixed release. Check the vendor site, and until you find one, fix the query in your own copy and restrict access.
Is a web application firewall enough?
Not by itself. It can slow down obvious attempts, but the unsafe query is still there. Use prepared statements and treat the filter as a stopgap.
Sources
The CVE record also lists third party write-ups and a VulDB entry. They are not vendor advisories, and this post does not reproduce any exploit detail from them.
Last reviewed: 18 October 2026.
