CVE-2025-8926: High SQL Injection in COVID 19 Testing System

CVE-2025-8926 is a high severity SQL injection in SourceCodester COVID 19 Testing Management System 1.0. The Username parameter handled by /login.php reaches a database query without safe handling. The record shows a CVSS score of 7.3 and lists no fixed version, so patch the query yourself or take the application offline.

What's affected

• Product: SourceCodester COVID 19 Testing Management System, version 1.0.
• Component: the file /login.php, through the Username argument.
• Weakness: CWE-74 (injection), CWE-89 (SQL injection).
• Score: CVSS 3.1 base 7.3, High. Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, which means network reachable, low complexity, no privileges and no user interaction, with limited impact on confidentiality, limited on integrity and limited on availability.
• Fixed version: none is listed in the record, and no vendor advisory was available to confirm one. Check the project page for any newer release before you rely on this.

The record gives a CVSS 3.1 base score only, so there is no second severity rating to reconcile.

The record states that the exploit has been disclosed to the public. It does not flag this CVE as exploited in the wild, and it is not in the CISA Known Exploited Vulnerabilities catalog. That is not the same as safe. A public write-up lowers the effort for anyone who wants to try it against an internet-facing copy.

How to check if you're exposed

Start with whether you run this software at all. Small PHP applications like this one are often downloaded as a sample project, deployed once and forgotten, so look for it on staging servers and shared hosts as well as production.

grep -rn "login.php" /var/www/html

If the file exists in a web root, open it and look for a query that joins the Username request value straight into an SQL string. Any query assembled by string concatenation is the pattern this CVE describes.

Next, check who can reach it. If the host is on the public internet, treat it as exposed. Review web server access logs for requests to /login.php with unusual values in Username, such as quote characters or SQL keywords, and note the dates. Then see what the database account behind the application can do:

SHOW GRANTS FOR CURRENT_USER();

An application account with broad rights turns a limited flaw into a larger one.

You can also run the free in-browser dependency scan at gold.safeguard.sh/scan on the project's manifest to see whether it pulls in other known-vulnerable packages. It will not find this bug, because the flaw is in the application's own code, but it is a fast way to see the rest of the exposure.

What to do now

1. Decide whether you still need the application. For a demo or a training project, the safest fix is to remove it from any network others can reach.
2. If you keep it, take it off the public internet or restrict it by IP address or VPN until it is fixed.
3. Replace the vulnerable query with a prepared statement. In PHP with PDO that looks like this:

$stmt = $pdo->prepare("SELECT * FROM items WHERE id = ?");
$stmt->execute([$_GET['id']]);

4. Apply the same change to every other query in the project that uses request input. Fixing one file leaves the rest.
5. Reduce the database account to the minimum rights the app needs, and rotate its password if you saw suspicious log entries.
6. Watch the project page and the CVE record for a fixed release, and update when one appears.

Why it matters

The root cause is CWE-74, a general injection weakness, and more specifically CWE-89, SQL injection. The application takes a value from the request and places it inside a database command. The database cannot tell the developer's intended query from the extra text an outsider supplies, so the outsider's text can change what the query does. Parameterized queries fix this because the value is sent separately from the command and is never parsed as SQL.

The impact here is scored with limited reach, partly because the reachable data depends on how the application and database are set up. In practice, a site that stores user accounts, orders or personal details deserves more caution than the score suggests. The fix is cheap, and the cost of skipping it is not.

Quick check

Sources

• Safeguard Gold entry: CVE-2025-8926 (NVD record data: description, CVSS, CWEs, published 2025-08-13)
• Reference listed in the record: https://github.com/lrjbsyh/CVE_Hunter/issues/2#issue-3307768438

Last reviewed: 18 October 2026.