CVE-2025-3184: Doctor Appointment Booking System SQLi Flaw

CVE-2025-3184 Overview

A critical SQL injection vulnerability has been identified in Projectworlds Online Doctor Appointment Booking System version 1.0. This issue affects the processing of the file /patient/profile.php?patientId=1, where manipulation of the patientFirstName parameter enables SQL injection attacks. The vulnerability can be exploited remotely without authentication, potentially allowing attackers to extract, modify, or delete sensitive patient data from the underlying database. The exploit has been publicly disclosed, and other parameters in this application may also be affected.

Critical Impact

Remote attackers can execute arbitrary SQL commands against the application database, potentially compromising patient records, authentication credentials, and other sensitive healthcare information.

Affected Products

• Projectworlds Online Doctor Appointment Booking System PHP and MySQL version 1.0

Discovery Timeline

• April 3, 2025 - CVE-2025-3184 published to NVD
• April 15, 2025 - Last updated in NVD database

Technical Details for CVE-2025-3184

Vulnerability Analysis

This SQL injection vulnerability exists due to improper handling of user-supplied input in the patient profile functionality. The application fails to properly sanitize or parameterize user input before incorporating it into SQL queries. When a user submits data through the patientFirstName parameter on the /patient/profile.php endpoint, the application directly concatenates this input into database queries without adequate validation. This allows an attacker to inject malicious SQL statements that the database server will execute with the same privileges as the application's database user.

The network-accessible nature of this vulnerability means that any attacker with internet access to the application can attempt exploitation without requiring prior authentication or special access privileges. Healthcare applications like this typically store highly sensitive Protected Health Information (PHI), making this vulnerability particularly concerning from a data privacy and regulatory compliance perspective.

Root Cause

The root cause of this vulnerability is a classic failure to implement proper input validation and parameterized queries (prepared statements) in the PHP application code. The patientFirstName parameter value is being directly incorporated into SQL query strings rather than being passed as a bound parameter to a prepared statement. This violates fundamental secure coding practices for database interaction. The vulnerability falls under CWE-89 (SQL Injection) and the broader category CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Attack Vector

The attack can be initiated remotely over the network without any authentication requirements. An attacker would craft a malicious HTTP request to the /patient/profile.php endpoint, injecting SQL syntax into the patientFirstName parameter. The injected SQL commands would then be executed by the database server, potentially allowing the attacker to:

• Extract sensitive patient data including names, addresses, and medical records
• Modify or delete database records
• Bypass authentication mechanisms
• Potentially gain access to other database tables or the underlying server depending on database configuration

The vulnerability affects the patient profile update functionality, and similar injection points may exist in other parameters throughout the application.

Detection Methods for CVE-2025-3184

Indicators of Compromise

• Unusual SQL error messages in application or web server logs, particularly referencing the /patient/profile.php endpoint
• Database query logs showing anomalous queries containing SQL keywords like UNION, SELECT, DROP, or comment sequences (--, /*)
• Multiple failed or suspicious requests to /patient/profile.php with malformed patientFirstName parameter values
• Unexpected database record modifications or deletions without corresponding legitimate user activity

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect SQL injection patterns in HTTP request parameters
• Implement database activity monitoring to alert on suspicious query patterns or unusual data access volumes
• Enable detailed logging on the web application and database servers to capture request parameters and query execution
• Use intrusion detection systems (IDS) with signatures for common SQL injection attack patterns

Monitoring Recommendations

• Monitor HTTP request logs for the /patient/profile.php endpoint, paying particular attention to the patientFirstName and similar input parameters
• Implement anomaly detection for database query patterns that deviate from normal application behavior
• Set up alerts for database errors related to SQL syntax, which may indicate attempted exploitation
• Review access logs for patterns of automated scanning or repeated requests with varying payloads

How to Mitigate CVE-2025-3184

Immediate Actions Required

• Remove or restrict public access to the Online Doctor Appointment Booking System until the vulnerability is addressed
• Implement input validation on all user-supplied parameters, particularly patientFirstName and related profile fields
• Deploy a Web Application Firewall (WAF) with SQL injection protection rules as an interim mitigation
• Review database logs for evidence of prior exploitation and assess potential data breach impact

Patch Information

No official patch information is currently available from the vendor. Organizations using this application should contact Projectworlds directly for remediation guidance. In the absence of vendor patches, organizations should consider the workarounds below and evaluate whether continued use of this application is appropriate given the security risk.

For additional technical details and vulnerability discussion, see the GitHub CVE Issue Discussion and VulDB entry #303143.

Workarounds

• Modify the application source code to use prepared statements (parameterized queries) for all database interactions involving user input
• Implement strict input validation using allowlists for acceptable characters in patient name fields
• Apply the principle of least privilege to database accounts used by the application to limit potential damage from successful exploitation
• Consider implementing additional authentication requirements before accessing profile modification functionality

# Example: Restrict access to the vulnerable endpoint via Apache .htaccess
# Place in the application's root directory or patient subdirectory
<Files "profile.php">
    Order Deny,Allow
    Deny from all
    # Allow only from trusted internal network
    Allow from 192.168.1.0/24
</Files>