CVE-2025-50455: EasyAppointments SQL Injection Vulnerability

CVE-2025-50455 Overview

CVE-2025-50455 is a SQL injection vulnerability in Alex Tselegidis EasyAppointments versions <= 1.5.1. The flaw resides in the order_by parameter of the /customers/search endpoint. Unsanitized user input flows into the order_by method of the CodeIgniter Query Builder, allowing attackers to inject arbitrary SQL. Attackers can perform time-based blind queries, enumerate database schemas, and extract sensitive customer data. Under permissive MySQL configurations that allow INTO OUTFILE, the vulnerability escalates to remote code execution by writing a PHP web shell to the webroot. The issue is tracked under CWE-89.

Critical Impact
Unauthenticated attackers can extract database contents and, under certain MySQL configurations, achieve remote code execution by writing a PHP shell via INTO OUTFILE.

Affected Products

Alex Tselegidis EasyAppointments <= 1.5.1
Deployments using CodeIgniter Query Builder order_by with unsanitized input
Instances backed by MySQL with secure_file_priv permitting INTO OUTFILE writes

Discovery Timeline

2026-07-27 - CVE-2025-50455 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2025-50455

Vulnerability Analysis

EasyAppointments exposes a /customers/search endpoint that accepts an order_by query parameter. The application passes this value directly to the CodeIgniter Query Builder order_by() method. CodeIgniter does not sanitize field identifiers passed to order_by(), so any injected SQL fragment becomes part of the final query. Attackers can append conditional expressions, subqueries, or UNION-style constructs after the ORDER BY clause. Time-based payloads using SLEEP() confirm exploitability without requiring visible output. Schema enumeration proceeds through information_schema reads chained into the ordering expression.

Root Cause

The root cause is missing input validation on identifier parameters passed through the ORM. CodeIgniter's order_by() method treats supplied strings as trusted SQL identifiers rather than user-controllable data. The application layer never restricts order_by to an allowlist of column names before invoking the query builder.

Attack Vector

An unauthenticated remote attacker sends a crafted HTTP request to /customers/search with a malicious order_by value. Injected SQL executes in the context of the EasyAppointments database user. When the MySQL service permits file writes via INTO OUTFILE and the web server directory is writable by the database process, the attacker writes a PHP shell into the webroot and invokes it over HTTP to execute arbitrary commands.

Refer to the GitHub Security Advisory and the proof-of-concept repository for validated payload structures.

Detection Methods for CVE-2025-50455

Indicators of Compromise

HTTP requests to /customers/search containing SQL keywords such as SLEEP, UNION, SELECT, INFORMATION_SCHEMA, or INTO OUTFILE in the order_by parameter.
New or unexpected .php files appearing in the EasyAppointments webroot after database activity.
MySQL query logs showing ORDER BY clauses containing subqueries, conditional expressions, or file-write operations.

Detection Strategies

Deploy web application firewall rules that inspect the order_by query parameter for SQL syntax and reject non-alphanumeric identifiers.
Enable MySQL general query logging and alert on ORDER BY clauses containing SLEEP, BENCHMARK, UNION, or INTO OUTFILE.
Monitor application response-time anomalies on /customers/search that correlate with time-based blind injection payloads.

Monitoring Recommendations

Alert on file creation events under the EasyAppointments webroot originating from the MySQL service account.
Track outbound connections and process launches from the PHP-FPM or web server process tied to EasyAppointments.
Aggregate authentication failures and 500-series responses on /customers/search in a centralized log platform for rapid triage.

How to Mitigate CVE-2025-50455

Immediate Actions Required

Restrict network access to EasyAppointments to trusted networks or place the application behind an authenticated reverse proxy.
Set the MySQL secure_file_priv variable to a non-writable directory or empty string to disable INTO OUTFILE writes.
Revoke FILE privileges from the EasyAppointments database user account.
Deploy WAF signatures that block SQL metacharacters in the order_by parameter of /customers/search.

Patch Information

No vendor patch is referenced in the NVD entry at the time of publication. Track the GitHub Security Advisory for fix availability and upgrade instructions. Once a fixed release above 1.5.1 is published, upgrade all EasyAppointments instances immediately.

Workarounds

Implement an allowlist in application code that constrains order_by values to known column names before invoking the query builder.
Apply strict input validation on all query-string parameters using a regular expression such as ^[a-zA-Z_]+$.
Run the MySQL service under a least-privilege account without filesystem write access to the web server document root.

bash

# MySQL hardening to block INTO OUTFILE abuse
# /etc/mysql/mysql.conf.d/mysqld.cnf
[mysqld]
secure_file_priv = /var/empty

# Revoke FILE privilege from the application database user
REVOKE FILE ON *.* FROM 'easyappointments'@'localhost';
FLUSH PRIVILEGES;