Vulnerability Description
SQL injection vulnerability exists in the order_by parameter of the /customers/search endpoint in Alex Tselegidis EasyAppointments <= 1.5.1. The vulnerability arises from unsanitized user input passed to the order_by method of the CodeIgniter Query Builder, enabling attackers to perform time-based queries and schema enumeration. Under certain MySQL configurations, the flaw may lead to remote code execution by writing a PHP shell using INTO OUTFILE.
CVSS Score
CRITICAL
Related Weaknesses (CWE)
References
- https://github.com/threatlance-org/security-advisories/blob/main/CVE-2025-50455/
- https://github.com/threatlance-org/security-advisories/blob/main/CVE-2025-50455/
- https://www.linkedin.com/posts/michael-chesang_cve-securityadvisory-appsec-activ
- https://github.com/threatlance-org/security-advisories/blob/main/CVE-2025-50455/
FAQ
What is CVE-2025-50455?
CVE-2025-50455 is a vulnerability with a CVSS score of 9.1 (CRITICAL). SQL injection vulnerability exists in the order_by parameter of the /customers/search endpoint in Alex Tselegidis EasyAppointments <= 1.5.1. The vulnerability arises from unsanitized user input passed...
How severe is CVE-2025-50455?
CVE-2025-50455 has been rated CRITICAL with a CVSS base score of 9.1/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2025-50455?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.