CVE-2025-4895
📋 TL;DR
A critical SQL injection vulnerability in SourceCodester Doctors Appointment System 1.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter in /admin/delete-session.php. This affects all deployments of version 1.0 that have the vulnerable file accessible. Attackers can potentially read, modify, or delete database content.
💻 Affected Systems
- SourceCodester Doctors Appointment System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, authentication bypass, and potential remote code execution if database functions allow it.
Likely Case
Unauthorized access to sensitive patient and appointment data, modification of database records, and potential privilege escalation.
If Mitigated
Limited impact with proper input validation and database permissions, potentially only error messages or limited data exposure.
🎯 Exploit Status
Public exploit available on GitHub, SQL injection is a well-understood attack vector with many automated tools.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.sourcecodester.com/
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a newer version if available, or implement workarounds.
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd proper input validation and parameterized queries to /admin/delete-session.php
Edit delete-session.php to use prepared statements with parameterized queries instead of direct string concatenation
File Access Restriction
allRestrict access to the vulnerable file using web server configuration
For Apache: Add 'Deny from all' to .htaccess in admin directory
For Nginx: Add 'location /admin/delete-session.php { deny all; }' to nginx.conf
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block SQL injection patterns
- Restrict network access to the application to trusted IPs only
🔍 How to Verify
Check if Vulnerable:
Test the /admin/delete-session.php endpoint with SQL injection payloads like ' OR '1'='1 in the ID parameterCheck Version:
Check the application version in the admin panel or source code filesVerify Fix Applied:
Verify that SQL injection payloads no longer execute and return appropriate error messages or are blocked📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in application logs
- Multiple requests to /admin/delete-session.php with suspicious parameters
Network Indicators:
- HTTP requests containing SQL keywords (SELECT, UNION, etc.) in URL parameters
SIEM Query:
source="web_logs" AND uri="/admin/delete-session.php" AND (param="*SELECT*" OR param="*UNION*" OR param="*OR*1=1*")