CVE Catalog
CVE-2025-64081
CriticalSummary
SQL injection vulnerability in /php/api_patient_schedule.php in SourceCodester Patients Waiting Area Queue Management System v1 allows attackers to execute arbitrary SQL commands via the appointmentID parameter.
Risk Assessment
An attacker can gain unauthorized access to the database, steal patient data, or modify data, potentially compromising system confidentiality and integrity.
Recommendation
Apply vendor patches or implement input validation and parameterized queries to remediate the vulnerability.
Original NVD description (English source)
SQL injection vulnerability in /php/api_patient_schedule.php in SourceCodester Patients Waiting Area Queue Management System v1 allows attackers to execute arbitrary SQL commands via the appointmentID parameter.