CVE-2025-50455
Received Received - Intake

SQL Injection in EasyAppointments

Publication date: 2026-07-27

Last updated on: 2026-07-27

Assigner: MITRE

Description
SQL injection vulnerability exists in the order_by parameter of the /customers/search endpoint in Alex Tselegidis EasyAppointments <= 1.5.1. The vulnerability arises from unsanitized user input passed to the order_by method of the CodeIgniter Query Builder, enabling attackers to perform time-based queries and schema enumeration. Under certain MySQL configurations, the flaw may lead to remote code execution by writing a PHP shell using INTO OUTFILE.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-27
Last Modified
2026-07-27
Generated
2026-07-27
AI Q&A
2026-07-27
EPSS Evaluated
N/A
NVD
CVE-2025-50455
EUVD
EUVD-2025-210522

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
alex_tselegidis easyappointments 1.5.1
alex_tselegidis easyappointments to 1.5.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2025-50455 is a blind SQL injection flaw in EasyAppointments versions up to 1.5.1. It exists in the order_by parameter of the /customers/search endpoint, which is passed unsanitized to CodeIgniter 3's Query Builder. Attackers can inject malicious SQL subqueries through this parameter, enabling boolean-based or time-based blind SQL injection. The vulnerability requires authenticated access with admin, provider, or secretary roles.

Detection Guidance

To detect this vulnerability, use a proof-of-concept script like poc_CVE-2025-50455.py from Resource 1. Run it with valid authentication credentials against endpoints like /customers/search or /admins/search. The script supports boolean-based and time-based detection methods. For manual testing, send POST requests with crafted order_by parameters such as (SELECT IF(condition, id, -id)) DESC for boolean mode or 1 ASC, (SELECT IF(condition, SLEEP(N), 0)) for time-based mode.

Impact Analysis

This vulnerability allows attackers to extract sensitive data like database information, user emails, and admin credentials. It can also enable file read operations if MySQL FILE privileges are available. In less restrictive MySQL setups, it may lead to remote code execution via INTO OUTFILE. Service disruption is another potential impact.

Compliance Impact

This vulnerability likely violates compliance requirements under GDPR and HIPAA due to unauthorized data access and potential data exfiltration. GDPR mandates protection of personal data, while HIPAA requires safeguarding protected health information. Exploitation could lead to unauthorized access to sensitive data, triggering regulatory penalties and compliance violations.

Mitigation Strategies

Immediately upgrade to the patched version in the develop branch (commit 0f0d71c) or apply the upstream patch that escapes the order_by parameter in Customers_model.php. If patching is not possible, manually validate and sanitize all user input in query parameters. Restrict database user privileges to prevent file write operations like INTO OUTFILE. Monitor for suspicious POST requests to vulnerable endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-50455. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart