{"id":"CVE-2025-50455","aliases":["EUVD-2025-210522","GHSA-mmxp-2737-66v3"],"status":"published","title":"SQL injection vulnerability exists in the order_by parameter of the /customers/search endpoint in...","description":"SQL injection vulnerability exists in the order_by parameter of the /customers/search endpoint in Alex Tselegidis EasyAppointments \u003c= 1.5.1. The vulnerability arises from unsanitized user input passed to the order_by method of the CodeIgniter Query Builder, enabling attackers to perform time-based queries and schema enumeration. Under certain MySQL configurations, the flaw may lead to remote code execution by writing a PHP shell using INTO OUTFILE.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.01105,"percentile":0.66061,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-89"],"published":"2026-07-27T00:00:00Z","modified":"2026-10-13T10:10:00Z","exploits":[{"source":"exploitdb","id":"EDB-52667","title":"EasyAppointments  1.5.1 - Blind SQL Injection","type":"webapps","platform":"multiple","date":"2026-09-01","url":"https://www.exploit-db.com/exploits/52667"}],"references":[{"url":"https://www.linkedin.com/posts/michael-chesang_cve-securityadvisory-appsec-activity-7360754900827365376-Z-IY"},{"url":"https://github.com/threatlance-org/security-advisories/blob/main/CVE-2025-50455/advisory.md","tags":["exploit"]},{"url":"https://github.com/threatlance-org/security-advisories/blob/main/CVE-2025-50455/poc.py"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-50455"},{"url":"https://github.com/advisories/GHSA-mmxp-2737-66v3"}],"sources":{"cve":[{"id":"CVE-2025-50455","description":"SQL injection vulnerability exists in the order_by parameter of the /customers/search endpoint in Alex Tselegidis EasyAppointments \u003c= 1.5.1. The vulnerability arises from unsanitized user input passed to the order_by method of the CodeIgniter Query Builder, enabling attackers to perform time-based queries and schema enumeration. Under certain MySQL configurations, the flaw may lead to remote code execution by writing a PHP shell using INTO OUTFILE.","status":"published","published":"2026-07-27T00:00:00Z","modified":"2026-07-27T17:40:00.291Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"adp"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:32:52.526476Z"}],"euvd":[{"id":"EUVD-2025-210522","description":"SQL injection vulnerability exists in the order_by parameter of the /customers/search endpoint in Alex Tselegidis EasyAppointments \u003c= 1.5.1. The vulnerability arises from unsanitized user input passed to the order_by method of the CodeIgniter Query Builder, enabling attackers to perform time-based queries and schema enumeration. Under certain MySQL configurations, the flaw may lead to remote code execution by writing a PHP shell using INTO OUTFILE.","status":"published","published":"2026-07-27T00:00:00Z","modified":"2026-07-27T17:40:00Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T18:02:33.886037Z"}],"ghsa":[{"id":"GHSA-mmxp-2737-66v3","title":"SQL injection vulnerability exists in the order_by parameter of the /customers/search endpoint in...","description":"SQL injection vulnerability exists in the order_by parameter of the /customers/search endpoint in Alex Tselegidis EasyAppointments \u003c= 1.5.1. The vulnerability arises from unsanitized user input passed to the order_by method of the CodeIgniter Query Builder, enabling attackers to perform time-based queries and schema enumeration. Under certain MySQL configurations, the flaw may lead to remote code execution by writing a PHP shell using INTO OUTFILE.","status":"published","published":"2026-07-27T18:31:47Z","modified":"2026-07-27T18:31:51Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:09:51.407039Z"}],"nvd":[{"id":"CVE-2025-50455","description":"SQL injection vulnerability exists in the order_by parameter of the /customers/search endpoint in Alex Tselegidis EasyAppointments \u003c= 1.5.1. The vulnerability arises from unsanitized user input passed to the order_by method of the CodeIgniter Query Builder, enabling attackers to perform time-based queries and schema enumeration. Under certain MySQL configurations, the flaw may lead to remote code execution by writing a PHP shell using INTO OUTFILE.","status":"published","published":"2026-07-27T16:16:58.86Z","modified":"2026-10-13T10:10:00.193Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"secondary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:12:02.535029Z"}]}}