CVE-2025-50455: SQL Injection
SQL injection vulnerability exists in the orderby parameter of the /customers/search endpoint in Alex Tselegidis EasyAppointments <= 1.5.1. The vulnerability arises from unsanitized user input passed to the orderby method of the CodeIgniter Query Builder, enabling attackers to perform time-based queries and schema enumeration. Under certain MySQL configurations, the flaw may lead to remote code execution by writing a PHP shell using INTO OUTFILE.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Alex Tselegidis EasyAppointmentsto a version that resolves this vulnerability.Fixed in 1.5.1 - Compensating control
Apply a compensating control at the network level to prevent the MySQL server from being accessed from untrusted networks while patching the Alex Tselegidis EasyAppointments SQL injection in the /customers/search endpoint (order_by parameter).
Event History
Frequently Asked Questions
What is the severity of CVE-2025-50455?
The severity of CVE-2025-50455 is rated as critical with a CVSS score of 9.1.
How do I fix CVE-2025-50455?
To fix CVE-2025-50455, sanitize and validate user input for the order_by parameter in the /customers/search endpoint.
What type of vulnerability is CVE-2025-50455?
CVE-2025-50455 is classified as an SQL injection vulnerability.
Which software is affected by CVE-2025-50455?
CVE-2025-50455 affects Alex Tselegidis EasyAppointments versions up to and including 1.5.1.
What can attackers do with CVE-2025-50455?
Attackers can exploit CVE-2025-50455 to perform unauthorized SQL queries that may compromise sensitive data.