CVE-2025-50455 in EasyAppointments
Summary
by MITRE • 07/27/2026
SQL injection vulnerability exists in the order_by parameter of the /customers/search endpoint in Alex Tselegidis EasyAppointments <= 1.5.1. The vulnerability arises from unsanitized user input passed to the order_by method of the CodeIgniter Query Builder, enabling attackers to perform time-based queries and schema enumeration. Under certain MySQL configurations, the flaw may lead to remote code execution by writing a PHP shell using INTO OUTFILE.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/27/2026
The SQL injection vulnerability identified in Alex Tselegidis EasyAppointments version 1.5.1 represents a critical security weakness within the customer search functionality that directly impacts the application's data integrity and confidentiality. This vulnerability specifically targets the order_by parameter of the /customers/search endpoint, where user input is inadequately validated or sanitized before being processed by the underlying database query mechanism. The flaw exists at the intersection of improper input handling and weak database abstraction layer security, creating an attack surface that malicious actors can exploit to manipulate the application's database interactions.
The technical implementation of this vulnerability leverages the CodeIgniter Query Builder's order_by method as the primary attack vector, where unsanitized user input flows directly into database query construction without proper parameterization or input filtering. This design flaw allows attackers to inject malicious SQL fragments that can alter the intended query execution path, enabling time-based blind SQL injection techniques that rely on conditional responses to infer database schema information and content. The vulnerability's exploitation potential is significantly amplified by the underlying MySQL configuration, which may permit file system access through the INTO OUTFILE functionality, creating a direct pathway for remote code execution.
The operational impact of this vulnerability extends beyond simple data theft or modification, as it provides attackers with comprehensive database enumeration capabilities that can reveal sensitive customer information, application architecture details, and potential credential stores. Time-based query exploitation techniques allow threat actors to systematically extract database schema information through response timing variations, while the potential for file system manipulation through INTO OUTFILE enables persistent access through PHP shell deployment. This vulnerability directly maps to CWE-89 SQL Injection and CWE-20 Improper Input Validation, with exploitation patterns aligning with ATT&CK technique T1071.004 Application Layer Protocol: Web Protocols and T1566 Phishing with Malicious File delivery.
Mitigation strategies for this vulnerability require immediate implementation of parameterized queries or prepared statements throughout the application's database interaction layers, with comprehensive input validation applied to all user-supplied parameters including the order_by field. The CodeIgniter Query Builder should be configured to enforce strict parameter binding and sanitize all dynamic inputs before query construction. Network-level protections such as web application firewalls should be deployed to monitor and block suspicious SQL injection patterns targeting database endpoints. Additionally, regular security assessments should validate that input sanitization measures are properly implemented across all dynamic query construction points, while database access controls should be restricted to minimize potential damage from successful exploitation attempts. The vulnerability's severity necessitates immediate patching of the EasyAppointments application to version 1.5.2 or later, where proper input validation and parameterized query handling have been implemented to prevent unauthorized database access and manipulation.