CVE-2025-50455

Name of the Vulnerable Software and Affected Versions Alex Tselegidis EasyAppointments versions prior to 1.5.2

Description An SQL injection issue exists in the '/customers/search' endpoint via the order by parameter. The flaw occurs because unsanitized user input is passed to the order by() function of the CodeIgniter Query Builder. This allows attackers to perform schema enumeration and time-based queries. In specific MySQL configurations, this can lead to remote code execution by writing a PHP shell using the INTO OUTFILE command.

Recommendations Update Alex Tselegidis EasyAppointments to a version newer than 1.5.1. Avoid using the order by parameter in the '/customers/search' endpoint until the software is updated.