CVE-2025-7750 in Online Appointment Booking System
Summary
by MITRE • 07/17/2025
A vulnerability, which was classified as critical, was found in code-projects Online Appointment Booking System 1.0. Affected is an unknown function of the file /admin/adddoctorclinic.php. The manipulation of the argument clinic leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/19/2025
This critical vulnerability exists within the code-projects Online Appointment Booking System version 1.0, specifically within the administrative component located at /admin/adddoctorclinic.php. The flaw represents a classic sql injection vulnerability that occurs when the clinic parameter is processed without adequate input validation or sanitization. This allows malicious actors to inject arbitrary sql commands through the clinic argument, potentially compromising the entire database infrastructure underlying the appointment booking system.
The technical exploitation of this vulnerability follows standard sql injection attack patterns where an attacker can manipulate the clinic input field to execute unauthorized database operations. The remote attack vector means that threat actors do not require physical access to the system or local network privileges to exploit this flaw, making it particularly dangerous for web applications. The vulnerability's classification as critical indicates that it could enable complete database compromise, data exfiltration, or even system takeover depending on the database permissions and configuration.
From an operational standpoint, this vulnerability poses significant risks to healthcare organizations using this booking system, as it could expose sensitive patient information, appointment records, and potentially administrative credentials stored in the database. The public disclosure of the exploit increases the likelihood of real-world attacks, as malicious actors can immediately leverage this knowledge to target vulnerable installations. The impact extends beyond simple data theft, as attackers could modify or delete critical appointment data, disrupt healthcare services, or create backdoors for persistent access.
Security practitioners should immediately implement multiple layers of defense including input validation, parameterized queries, and web application firewalls to protect against this specific sql injection flaw. The vulnerability aligns with CWE-89 which catalogs sql injection weaknesses, and maps to ATT&CK technique T1190 for exploiting vulnerabilities in web applications. Organizations should conduct immediate vulnerability assessments across all instances of this software, apply the latest security patches if available, and implement network segmentation to limit potential attack surfaces. Regular security audits and code reviews should be performed to identify similar injection vulnerabilities in other application components and ensure proper database access controls are in place to minimize the impact of any successful exploitation attempts.