CVE-2025-4248 is a medium severity (CVSS 6.3) SQL injection in SourceCodester Simple To-Do List System 1.0. The ID parameter handled by /complete_task.php reaches a database query unsafely, and the record says the attack can run remotely. No fixed version is confirmed, so patch the query or limit access.
What's affected
SourceCodester Simple To-Do List System, version 1.0, per the record. The affected code is /complete_task.php, and the parameter named in the record is ID.
The record scores the issue 6.3 with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. In plain terms: reachable over the network, low attack complexity, no privileges and no user interaction needed, with limited impact on confidentiality, integrity and availability. The record also says the exploit has been disclosed to the public and may be used. It does not say the flaw is exploited in the wild, and the CVE is not on the CISA Known Exploited Vulnerabilities list.
The record does not name a patched release, and I could not confirm one from the advisory pages, which were not reachable when this post was reviewed. Check the vendor site for a newer version, and if there is none, treat the code as needing a local fix.
How to check if you're exposed
First, find out whether you run this application at all. These small PHP and MySQL projects are often installed from a downloaded source archive, so there may be no package manager entry. Look on your web servers for the project folder and its version notes:
find /var/www -type f -name "complete_task.php" 2>/dev/null
If a copy turns up, open that file and read how the ID value is used. The warning sign is a value from the request being joined into an SQL string. Safe code passes values as bound parameters instead.
Then check the web server access logs for requests to /complete_task.php that you do not recognize, especially from addresses outside your organization, and for database errors that appear around the same times.
If the application is only used internally, confirm that it is really not reachable from the internet. A quick check from outside your network is more reliable than assuming.
What to do now
- Inventory every copy of SourceCodester Simple To-Do List System you run, including test and demo installs.
- Check the vendor site for a newer release and read its notes. Only rely on a fix you can confirm.
- If no fix exists, change the query that uses ID to use bound parameters, and validate the input type.
- Put the application behind a login or VPN, or take it offline if it is not needed.
- Restrict the database account the application uses to the tables it needs, with no administrative rights.
- Review access and database logs for the period since the application was first exposed.
A safe pattern, shown here with PHP and mysqli, looks like this. The query text never contains the request value:
$stmt = $mysqli->prepare("SELECT id FROM example WHERE name = ?");
$stmt->bind_param("s", $value);
$stmt->execute();
Why it matters
The weakness is classed as CWE-89, SQL injection, which falls under the broader CWE-74, improper neutralization of special elements in output used by a downstream component. In both cases the application builds a command for another system, here a database, out of text that an outside user can influence, and the database cannot tell the difference between the intended command and the added part.
For a small business system holding people's records, that can mean exposure or alteration of stored data. The exact impact depends on the database account the application uses and the data it holds.
Applications like this are often unmaintained or lightly maintained, which is why a missing patch note should be read as a reason to fix the code yourself rather than wait.
You can also check the open source libraries behind your own applications with the free in-browser dependency scan at gold.safeguard.sh/scan. It reads dependency manifests, so it will not find a hand written query flaw like this one, but it covers the packages around it.
Quick check
Does this CVE have a confirmed fix?
Not that I could confirm. The record gives no fixed version. Check the vendor site, and if nothing newer exists, fix the query or restrict access.
Is it exploited in the wild?
The record says an exploit was disclosed publicly and may be used. It is not on the CISA KEV list, and no advisory I could reach reports active exploitation.
Sources
Last reviewed: 18 October 2026.
