CVE-2025-64081

Step 1: Payload Delivery: The attacker crafts a malicious SQL injection payload designed to be inserted into the appointmentID parameter of a request to /php/api_patient_schedule.php.

Step 2: Request Submission: The attacker submits the crafted payload via an HTTP GET or POST request to the vulnerable endpoint.

Step 3: Query Execution: The application receives the request and incorporates the attacker-supplied appointmentID value directly into an SQL query without proper sanitization.

Step 4: SQL Injection: The database server interprets the injected SQL code as part of the query, allowing the attacker to execute arbitrary SQL commands.

Step 5: Data Exfiltration/System Compromise: Depending on the injected SQL commands, the attacker can then retrieve sensitive data (e.g., patient records, credentials), modify data, or potentially gain control over the underlying server.

The vulnerability stems from insufficient input validation and sanitization of the appointmentID parameter within the /php/api_patient_schedule.php script. The application directly incorporates user-supplied data from this parameter into SQL queries without proper escaping or filtering. This allows an attacker to inject malicious SQL code, altering the intended query logic and enabling unauthorized database interactions. The root cause is a lack of parameterized queries or prepared statements, which would have prevented the injection of malicious SQL code.