EUVD-2025-21246Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Input neutralization, injection prevention
|
| Impact | Multiple signals indicate HIGH real-world risk despite CVSS 7.3 (High, not Critical as mislabeled in description): (1) CVSS 3.1 vector shows AV:N (network-accessible), AC:L (low complexity), PR:N (no privileges required), UI:N (no user interaction) - all maximum-impact settings indicating trivial exploitation; (2) Public POC availability significantly increases exploitation probability; (3) SQL injection with unauthenticated access typically maps to EPSS >0.95 (extremely likely to be exploited); (4) No KEV status provided, but public disclosure + exploitable nature suggests active exploitation is probable; (5) SSVC framework assessment: Exploitation=Proof-of-Concept (public), Automatable=Yes (SQL injection is trivially scriptable), Technical Impact=Total (complete database compromise possible). This represents an immediate production risk requiring urgent patching. The 7.3 CVSS underrates the criticality—this should be treated as Critical in practice. |
| Exploit ScenarioDerived | An attacker discovers the application via search engine or vulnerability disclosure. They craft a request to http://target.com/ulocateus.php?doctorname=' OR '1'='1 to bypass authentication logic or extract data. A more sophisticated attack injects UNION-based payload: doctorname=' UNION SELECT user, password FROM admin_users -- to exfiltrate credentials. The POC code (now publicly available) automates database enumeration, table extraction, and privilege escalation. Due to the unauthenticated, network-accessible nature, this can be exploited at scale against all exposed instances without requiring valid appointments or user accounts. Attack execution time: <5 minutes for basic data exfiltration. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAI
CVE-2025-7515 is a critical SQL injection vulnerability in code-projects Online Appointment Booking System version 1.0, specifically in the /ulocateus.php file where the 'doctorname' parameter is insufficiently sanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of database contents. The vulnerability has been publicly disclosed with proof-of-concept code available, increasing real-world exploitation risk.
RemediationAI
{'type': 'Patching', 'description': 'Upgrade to a patched version >1.0 if available from code-projects. No specific patch version identified in available intelligence; contact vendor directly or monitor security advisories.'} {'type': 'Immediate Mitigation (if patching unavailable)', 'steps': ["Implement Web Application Firewall (WAF) rules to block SQL injection patterns in the 'doctorname' parameter (e.g., detect single quotes, SQL keywords like UNION, SELECT, DROP)", 'Disable or restrict access to /ulocateus.php if not critical to operations', 'Implement rate limiting and IP-based access controls to the vulnerable endpoint']} {'type': 'Code-Level Fix (if in-house deployment)', 'steps': ['Replace all string concatenation in SQL queries with parameterized prepared statements (e.g., mysqli_prepare() or PDO prepared statements in PHP)', "Implement input validation: whitelist allowed characters for 'doctorname' (alphanumeric, spaces, hyphens only)", 'Apply output encoding for any database results displayed to users', 'Conduct full code review of /ulocateus.php and related database interaction code']} {'type': 'Detection', 'steps': ['Monitor database query logs for unusual SQL patterns or errors originating from /ulocateus.php', 'Enable SQL error logging and alerting', "Review web server access logs for suspicious characters in 'doctorname' parameter (encoded quotes, SQL keywords)"]}
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in a PHP-based web application (code-projects Online Appointment Booking System 1.0) that likely uses a MySQL or similar relational database backend. The root cause is CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - 'Injection'), manifesting as SQL injection. The /ulocateus.php endpoint accepts user-supplied input via the 'doctorname' parameter without proper parameterized queries, prepared statements, or input validation/sanitization. This allows attackers to inject SQL metacharacters and malicious SQL commands into database queries. The affected CPE would be: cpe:2.3:a:code-projects:online_appointment_booking_system:1.0:*:*:*:*:*:*:*
Know when Online Appointment Booking System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability classified as critical has been found in code-projects Online Appointment Booking System 1.0. This affects an unknown part of the file /ulocateus.php. The manipulation of the argument doctorname leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Executive ViewAI
A SQL injection vulnerability in the Online Appointment Booking System 1.0 allows unauthenticated remote attackers to compromise the database through the doctor name input field. Public exploits are available, creating immediate risk to patient data, appointment records, and system integrity for organizations using this software.
Implement WAF rules blocking SQL metacharacters in doctorname parameter; restrict /ulocateus.php to authorized networks only; disable the affected functionality if non-critical; implement database activity monitoring (DAM) for anomalous queries; apply strict input validation and parameterized queries at application level if source code is accessible; conduct emergency security patching when vendor releases update; consider disabling appointment booking feature until remediated.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Missing authorization in the Admin/showdoctor.php admin display page of girishsaraf's Online-Appointment-Booking-System
SQL injection in the Admin/deleteclinic.php endpoint of girishsaraf's Appointment Booking System allows remote attackers
SQL injection in the girishsaraf Online-Appointment-Booking-System (rolling release) lets unauthenticated remote attacke
Unauthenticated SQL injection in the patient login handler of girishsaraf's Online-Appointment-Booking-System lets remot
SQL injection in the Admin/getclinic.php AJAX endpoint of girishsaraf's Online-Appointment-Booking-System lets remote at
Unauthenticated SQL injection in the signup.php registration handler of girishsaraf Online-Appointment-Booking-System le
Unauthenticated SQL injection in the Doctor Search endpoint (locateus.php) of girishsaraf's Online-Appointment-Booking-S
Unauthenticated SQL injection in the administrative login handler (Admin/mlogin.php) of girishsaraf's Online-Appointment
We are tasked with synthesizing a JSON analysis for CVE-2025-7752. Let's collect data: - CVE ID: CVE-2025-7752 - Descri
SQL injection in code-projects Online Appointment Booking System 1.0 allows remote unauthenticated attackers to manipula
SQL injection in code-projects Online Appointment Booking System 1.0 allows remote unauthenticated attackers to execute
SQL injection in code-projects Online Appointment Booking System 1.0 allows remote attackers to execute arbitrary SQL co
Exploit-DB