CVE-2025-13248
📋 TL;DR
This CVE describes a SQL injection vulnerability in SourceCodester Patients Waiting Area Queue Management System 1.0. Attackers can remotely exploit the /php/api_patient_schedule.php endpoint by manipulating the appointmentID parameter to execute arbitrary SQL commands. All deployments of this specific software version are affected.
💻 Affected Systems
- SourceCodester Patients Waiting Area Queue Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise allowing data theft, modification, or deletion; potential system takeover via SQL injection to RCE if database configuration permits.
Likely Case
Unauthorized access to patient scheduling data, appointment manipulation, and potential extraction of sensitive information from the database.
If Mitigated
Limited impact with proper input validation and parameterized queries preventing SQL injection execution.
🎯 Exploit Status
Exploit code is publicly available on GitHub, making this easily exploitable by attackers with basic skills.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.sourcecodester.com/
Restart Required: No
Instructions:
No official patch available. Check vendor website for updates. Consider implementing parameterized queries and input validation in /php/api_patient_schedule.php.
🔧 Temporary Workarounds
Web Application Firewall (WAF)
allDeploy a WAF with SQL injection protection rules to block malicious requests.
Input Validation Filter
allImplement server-side validation to only accept numeric values for appointmentID parameter.
// PHP example: if(!is_numeric($_GET['appointmentID'])) { die('Invalid input'); }
🧯 If You Can't Patch
- Isolate the system behind a firewall with strict access controls
- Implement network segmentation to limit database access from application server
🔍 How to Verify
Check if Vulnerable:
Test the /php/api_patient_schedule.php endpoint with SQL injection payloads like: appointmentID=1' OR '1'='1Check Version:
Check application files or documentation for version information. Look for version markers in source code.Verify Fix Applied:
Verify that SQL injection payloads no longer work and return error messages or are properly sanitized.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in application logs
- Multiple failed login attempts or parameter manipulation in access logs
Network Indicators:
- HTTP requests to /php/api_patient_schedule.php with SQL keywords in parameters
- Unusual database query patterns from application server
SIEM Query:
source="web_logs" AND uri_path="/php/api_patient_schedule.php" AND (query_string="*OR*" OR query_string="*UNION*" OR query_string="*SELECT*" OR query_string="*'*'*")