CVE-2025-4817 MEDIUM

CVE-2025-4817: Sourcecodester Doctor's Appointment System GET Parameter delete-appointment.php sql injection

Vendor Sourcecodester
Product Doctor's Appointment System
Weakness CWE-89 · SQLi
Published May 17, 2025
Last update May 19, 2025
View on NVD All CVEs

CVSS base score

6.9/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

What the vulnerability does

01Description

A vulnerability was found in Sourcecodester Doctor's Appointment System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/delete-appointment.php of the component GET Parameter Handler. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Key dates

02Disclosure timeline

May 17, 2025 CVE published
May 19, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-7668 SourceCodester Car Driving School Management System Master.php delete_package sql injection CVE-2025-10811 code-projects Hostel Management System index.php sql injection CVE-2025-30525 WordPress WP Profitshare plugin <= 1.4.9 - SQL Injection vulnerability CVE-2025-59939 WeGIA vulnerable to SQL Injection into method `excluir` of the `ProdutoControle` class in the parameter `id_produto`. CVE-2025-8179 PHPGurukul Local Services Search Engine Management System changeimage.php sql injection