SQL Injection Vulnerability in Patients Waiting Area Queue Management System by SourceCodester
CVE-2025-64081
9.8CRITICAL
Key Information:
- Vendor
SourceCodester
- Vendor
- CVE Published:
- 8 December 2025
What is CVE-2025-64081?
An SQL injection vulnerability exists in the Patients Waiting Area Queue Management System by SourceCodester, specifically within the api_patient_schedule.php endpoint. This flaw allows attackers to manipulate the appointmentID parameter, enabling them to execute arbitrary SQL commands. Exploiting this vulnerability could lead to unauthorized access to sensitive data or even complete control over the affected database.
References
CVSS V3.1
Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved