CVE-2025-4895: Doctors Appointment System SQLi Vulnerability

CVE-2025-4895 Overview

A critical SQL injection vulnerability has been identified in SourceCodester Doctors Appointment System version 1.0. The vulnerability exists in the file /admin/delete-session.php where the ID parameter is not properly sanitized before being used in SQL queries. This flaw allows remote attackers to manipulate database queries, potentially leading to unauthorized data access, modification, or deletion.

Critical Impact

Remote attackers can exploit this SQL injection vulnerability to access, modify, or delete sensitive healthcare appointment data without authentication, potentially compromising patient information and system integrity.

Affected Products

• SourceCodester Doctors Appointment System 1.0
• Hshnudr Doctors Appointment System

Discovery Timeline

• May 18, 2025 - CVE-2025-4895 published to NVD
• May 21, 2025 - Last updated in NVD database

Technical Details for CVE-2025-4895

Vulnerability Analysis

This SQL injection vulnerability stems from improper input validation in the /admin/delete-session.php file of the Doctors Appointment System. The application fails to sanitize user-supplied input through the ID parameter before incorporating it into SQL queries. This classic injection flaw (CWE-89) allows attackers to craft malicious input that alters the intended SQL statement execution.

The vulnerability is exploitable remotely over the network without requiring any user interaction or prior authentication. Successful exploitation could allow attackers to extract sensitive patient and appointment data, modify database records, or potentially gain further access to the underlying system.

Root Cause

The root cause is a failure to implement proper input validation and parameterized queries in the PHP application. The ID parameter passed to /admin/delete-session.php is directly concatenated into SQL statements without sanitization or the use of prepared statements. This violates secure coding practices for database interactions and creates a direct injection point for malicious SQL commands.

Attack Vector

The attack is initiated remotely over the network. An attacker can craft HTTP requests to the /admin/delete-session.php endpoint with malicious SQL payloads in the ID parameter. Since the vulnerability exists in an administrative function, successful exploitation could provide access to administrative operations and sensitive data.

The vulnerability is classified under CWE-89 (SQL Injection) and CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component). The exploit has been publicly disclosed, increasing the risk of active exploitation attempts.

For technical details regarding the vulnerability, refer to the GitHub Issue CVE-11 and VulDB entry #309449.

Detection Methods for CVE-2025-4895

Indicators of Compromise

• Unusual SQL error messages in application logs originating from /admin/delete-session.php
• HTTP requests to /admin/delete-session.php containing SQL syntax characters (single quotes, UNION, SELECT, etc.) in the ID parameter
• Unexpected database queries or data access patterns in database audit logs
• Anomalous data modifications or deletions in appointment session records

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect and block SQL injection patterns targeting the ID parameter
• Implement database activity monitoring to alert on suspicious query patterns, especially those containing UNION-based or time-based injection techniques
• Configure application logging to capture all requests to administrative endpoints including full parameter values
• Use intrusion detection systems with signatures for common SQL injection payloads

Monitoring Recommendations

• Enable detailed access logging for the /admin/ directory and monitor for suspicious parameter values
• Set up alerts for database errors that may indicate failed injection attempts
• Monitor for unusual data exfiltration patterns or large query result sets from the application database
• Review web server logs regularly for reconnaissance activity targeting PHP administrative endpoints

How to Mitigate CVE-2025-4895

Immediate Actions Required

• Restrict access to the /admin/ directory using IP whitelisting or VPN-only access until a patch is applied
• Implement Web Application Firewall (WAF) rules to filter SQL injection attempts on the ID parameter
• Review and audit all database queries in the application for similar injection vulnerabilities
• Consider taking the application offline if it processes sensitive healthcare data until remediation is complete

Patch Information

No official vendor patch has been identified at this time. Organizations using SourceCodester Doctors Appointment System 1.0 should contact the vendor or consider alternative solutions. Monitor SourceCodester for any security updates or patches.

Workarounds

• Implement input validation on the ID parameter to accept only numeric values
• Deploy a reverse proxy or WAF with SQL injection detection rules in front of the application
• Modify the source code to use prepared statements with parameterized queries for all database operations
• Implement the principle of least privilege for database accounts used by the application to limit potential damage from successful exploitation

# Example Apache .htaccess restriction for /admin/ directory
<Directory "/var/www/html/admin">
    # Restrict access to specific IP addresses only
    Require ip 192.168.1.0/24
    Require ip 10.0.0.0/8
    # Deny all other access
    Require all denied
</Directory>