CVE-2025-13122: Pamzey Queue Management System SQLi Flaw

CVE-2025-13122 Overview

A SQL Injection vulnerability has been identified in SourceCodester Patients Waiting Area Queue Management System version 1.0. The vulnerability exists in the getPatientAppointment function within the /php/api_patient_checkin.php file. Attackers can exploit this flaw by manipulating the appointmentID argument to inject malicious SQL statements, potentially allowing unauthorized access to sensitive patient data stored in the backend database.

Critical Impact

This SQL injection vulnerability in a healthcare queue management system could expose sensitive patient appointment data, enable unauthorized database access, and potentially compromise the integrity of healthcare operations. The exploit is publicly available, increasing the risk of exploitation.

Affected Products

• Pamzey Patients Waiting Area Queue Management System version 1.0
• SourceCodester Patients Waiting Area Queue Management System 1.0

Discovery Timeline

• November 13, 2025 - CVE-2025-13122 published to NVD
• November 17, 2025 - Last updated in NVD database

Technical Details for CVE-2025-13122

Vulnerability Analysis

This vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) and CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component). The vulnerable endpoint /php/api_patient_checkin.php processes the appointmentID parameter without proper sanitization or parameterized query handling, allowing attackers to inject arbitrary SQL commands.

The attack can be initiated remotely over the network without requiring authentication, making it accessible to unauthenticated attackers. The vulnerability allows for potential data exfiltration of patient records, modification of appointment data, and in severe cases, could lead to complete database compromise depending on the database user privileges configured for the application.

Root Cause

The root cause of this vulnerability stems from improper input validation in the getPatientAppointment function. The appointmentID parameter is directly concatenated or interpolated into SQL queries without proper sanitization, prepared statements, or parameterized queries. This failure to implement secure coding practices for database interactions allows user-supplied input to be interpreted as SQL commands rather than data values.

Attack Vector

The attack is network-based, requiring no user interaction or prior authentication. An attacker can craft malicious HTTP requests to the /php/api_patient_checkin.php endpoint, injecting SQL payloads through the appointmentID parameter. Successful exploitation could allow the attacker to:

• Extract sensitive patient appointment data from the database
• Modify or delete existing records
• Bypass authentication mechanisms if present
• Potentially escalate privileges within the database context

The vulnerability can be exploited by sending crafted requests containing SQL injection payloads in the appointmentID field. For example, manipulating this parameter with union-based, boolean-based, or time-based injection techniques could reveal database structure and contents. Technical details and proof-of-concept information are available through the VulDB submission.

Detection Methods for CVE-2025-13122

Indicators of Compromise

• Unusual SQL error messages in application logs from /php/api_patient_checkin.php
• Unexpected database queries containing SQL keywords like UNION, SELECT, DROP, or comment sequences (--, /**/)
• Abnormal patterns in the appointmentID parameter values in web server access logs
• Database audit logs showing unauthorized data access or schema enumeration attempts

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect SQL injection patterns in the appointmentID parameter
• Monitor HTTP request logs for suspicious characters and SQL syntax in GET/POST parameters to /php/api_patient_checkin.php
• Deploy database activity monitoring to detect anomalous query patterns or unauthorized data access
• Utilize intrusion detection systems (IDS) with signatures for common SQL injection attack patterns

Monitoring Recommendations

• Enable detailed logging on the web server and database server to capture all requests to the vulnerable endpoint
• Configure alerts for database errors or unusual query execution patterns
• Review access logs regularly for requests containing encoded or obfuscated SQL injection payloads
• Monitor for bulk data extraction attempts that could indicate successful exploitation

How to Mitigate CVE-2025-13122

Immediate Actions Required

• Restrict access to the /php/api_patient_checkin.php endpoint using network-level controls or authentication requirements
• Implement input validation to allow only numeric values for the appointmentID parameter
• Deploy a Web Application Firewall (WAF) with SQL injection protection rules as an interim measure
• Review database user privileges and apply principle of least privilege to limit potential damage from exploitation

Patch Information

No official vendor patch is currently available for this vulnerability. Organizations using SourceCodester Patients Waiting Area Queue Management System version 1.0 should implement the workarounds below and monitor the SourceCodester website for security updates. Additional technical information can be found in the VulDB advisory.

Workarounds

• Modify the source code to implement prepared statements or parameterized queries for all database interactions involving the appointmentID parameter
• Add input validation to ensure appointmentID accepts only integer values and reject any input containing SQL metacharacters
• Consider taking the affected application offline or restricting access to trusted networks until a proper fix is implemented
• Implement database-level stored procedures to abstract direct SQL query construction from the application layer

# Example: Add input validation in PHP (manual remediation)
# In api_patient_checkin.php, validate appointmentID before use:
# $appointmentID = filter_input(INPUT_GET, 'appointmentID', FILTER_VALIDATE_INT);
# if ($appointmentID === false || $appointmentID === null) {
#     die("Invalid appointment ID");
# }
# Use prepared statements with PDO or mysqli