CVE-2025-50383: SQL Injection Vulnerability in Easy!Appointments
Summary
CVE-2025-50383: Easy!Appointments SQL injection vulnerability. Affects alextselegidis/easyappointments versions < 1.5.2-beta.1. Fixed in 1.5.2-beta.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Easy!Appointments is an open-source appointment scheduling software that allows users to manage appointments efficiently. It provides features such as calendar integration, client management, and customizable booking forms. However, version 1.5.1 of Easy!Appointments has been found to be vulnerable to a SQL injection attack, which could allow unauthorized access to the database and manipulation of data.
Vulnerability Detail
The vulnerability arises from improper handling of user input in the 'order_by' parameter, which can be exploited by attackers to execute arbitrary SQL queries. This could lead to unauthorized data access, data corruption, or even complete database compromise. The issue is classified under CWE-89, indicating that it is a SQL injection vulnerability, which is a common and serious security flaw in web applications.
How To Fix
Minimum fixed version
1.5.2-beta.1
This is the first release that contains the fix.
composer require alextselegidis/easyappointments:1.5.2-beta.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can validate and sanitize the input for the 'order_by' parameter to prevent SQL injection attacks. This can be done by implementing parameterized queries or using prepared statements in the database interactions.
Conclusion
The SQL injection vulnerability in Easy!Appointments version 1.5.1 poses a significant risk to users. It is crucial to update to the latest version to mitigate this risk. Additionally, employing input validation can serve as a temporary workaround until the update is applied.
See every vulnerability recorded for alextselegidis/easyappointments →
FAQ
The vulnerability is a SQL injection flaw that allows attackers to manipulate database queries through unsanitized user input.
If you are using Easy!Appointments version 1.5.1, your application is vulnerable. You can check your application's composer.lock file using Vulert to see if it is affected.
Exploitation of this vulnerability could lead to unauthorized access to sensitive data, data corruption, or complete control over the database.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using just the composer.lock file.
If you cannot update immediately, implement input validation and sanitization for the 'order_by' parameter as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for alextselegidis/easyappointments.
