Online Appointment Booking System CVE-2025-14939

Exploitation requires high-level administrative authentication to the Online Appointment Booking System admin panel - the vulnerable /admin/deletemanager.php endpoint is not remotely exploitable without valid admin credentials. No unauthenticated SQL injection exists; the 'remote' attack vector in CVSS means the admin panel is accessible over the network, not that authentication is bypassed. The SQL injection payload must be delivered via the managername HTTP parameter during a DELETE manager request while authenticated as an admin user. Default, misconfigured, or unpatched installations with weak admin passwords are at highest risk; systems with strong credential management and network segmentation of admin access face minimal practical risk.

Real-world risk is LOW despite public POC availability. Multiple mitigating signals converge: CVSS 2.0 score, EPSS 0.05% (14th percentile), and critically the PR:H (high privilege) requirement in CVSSv4 vector. An attacker must already possess valid administrative credentials to reach the vulnerable endpoint, which transforms this from a remote unauthenticated attack into a post-compromise lateral movement or insider threat scenario. The limited impact scope (VC:L/VI:L/VA:L - confidentiality, integrity, availability all limited) further reduces urgency. POC existence is notable but not actionable without admin credentials. The vulnerability is NOT actively exploited in the wild per available signals (no KEV status), and the high privilege barrier suggests this will remain a low-frequency attack vector despite code publication. Organizations running this legacy software with weak admin credential hygiene face elevated risk.

An attacker with stolen or compromised admin credentials logs into the admin panel and navigates to the deletemanager function. They inject a SQL metacharacter sequence (e.g., single quotes, UNION operators) into the managername parameter, bypassing the intended DELETE query logic to extract sensitive data from other database tables (e.g., user credentials, appointment details) or modify records. The attack succeeds because the PHP code concatenates user input directly into the SQL statement without parameterized preparation.