CVE-2025-56608

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-56608
The SourceCodester Android application "Corona Virus Tracker App India" 1.0 uses MD5 for digest authentication in `OkHttpClientWrapper.java`. The `handleDigest()` function employs `MessageDigest.getInstance("MD5")` to hash credentials. MD5 is a broken cryptographic algorithm known to allow hash collisions. This makes the authentication mechanism vulnerable to replay, spoofing, or brute-force attacks, potentially leading to unauthorized access. The vulnerability corresponds to CWE-327 and aligns with OWASP M5: Insufficient Cryptography and MASVS MSTG-CRYPTO-4.

4.2 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.6 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/MobSF/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#identifying-insecure-andor-deprecated-cryptographic-algorithms-mstg-crypto-4 Technical Description
https://github.com/anonaninda/Aninda-security-advisories/blob/main/CVE-2025-56608.md Third Party Advisory
https://www.sourcecodester.com/android/14292/android-corona-virus-tracker-app-india-using-b4a.html Product
Configurations

Configuration 1 (hide)

cpe:2.3:a:donbermoy:android_corona_virus_tracker_app_for_india:1.0:*:*:*:*:*:*:*
History

08 Sep 2025, 17:40

Type Values Removed Values Added
CPE cpe:2.3:a:donbermoy:android_corona_virus_tracker_app_for_india:1.0:*:*:*:*:*:*:*
First Time Donbermoy
Donbermoy android Corona Virus Tracker App For India
References () https://github.com/MobSF/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#identifying-insecure-andor-deprecated-cryptographic-algorithms-mstg-crypto-4 - () https://github.com/MobSF/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#identifying-insecure-andor-deprecated-cryptographic-algorithms-mstg-crypto-4 - Technical Description
References () https://github.com/anonaninda/Aninda-security-advisories/blob/main/CVE-2025-56608.md - () https://github.com/anonaninda/Aninda-security-advisories/blob/main/CVE-2025-56608.md - Third Party Advisory
References () https://www.sourcecodester.com/android/14292/android-corona-virus-tracker-app-india-using-b4a.html - () https://www.sourcecodester.com/android/14292/android-corona-virus-tracker-app-india-using-b4a.html - Product

03 Sep 2025, 20:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.2
CWE CWE-290

03 Sep 2025, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-09-03 15:15

Updated : 2025-09-08 17:40

NVD link : CVE-2025-56608

Mitre link : CVE-2025-56608

CVE.ORG link : CVE-2025-56608

JSON object : View

Products Affected

donbermoy

  • android_corona_virus_tracker_app_for_india
CWE
CWE-290

Authentication Bypass by Spoofing