External risk intelligence

EasyAppointments SQL Injection Allows Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2025-50455

The vulnerability affects a customer search endpoint in a web application. Such endpoints are typically designed to be accessible to users over the internet as part of standard application functionality, making it likely that this interface is exposed in common deployments.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical security flaw has been identified in the EasyAppointments software that could allow unauthorized access to sensitive customer information. This SQL injection vulnerability affects how the software searches and sorts customer data, and in some configurations, it could potentially lead to attackers executing malicious code on affected systems. The primary concern is to determine if our organization utilizes this specific software and, if so, to what extent.

Unsanitized input allows data access.
Critical flaw affects customer search functionality.
Confirm relevance and exposure to our systems.

Attack Path

How an attacker could exploit the issue

An attacker can target the customer search feature to inject malicious SQL commands. This occurs because the application does not properly check the user-provided 'order_by' parameter before using it in a database query. If successful, an attacker could potentially gain unauthorized access to sensitive information or even execute arbitrary code on the server.

Unauthenticated network access to search endpoint.
Input to 'order_by' parameter is not sanitized.
Sensitive data exposure and potential code execution.

Live Threat

Current exploitation, exposure, and threat context

A SQL injection vulnerability in the `order_by` parameter of the `/customers/search` endpoint could allow unauthenticated attackers to execute arbitrary SQL queries. When supported by specific MySQL configurations, this could enable attackers to perform time-based queries, enumerate the database schema, and potentially achieve remote code execution by writing a PHP shell.

Customer data and database schema.
Via unsanitized user input to the search endpoint.
Remote code execution and data exposure.

Operational Fix

Recommended remediation, mitigation, and detection steps

Identifying affected systems and accountable owners is the first priority for addressing this SQL injection vulnerability. Application owners, in conjunction with infrastructure or platform teams, should determine the scope of impact, focusing on instances of the EasyAppointments software that are internet-facing or handle sensitive customer data. Once identified and prioritized by risk, a plan for remediation, which may involve vendor coordination or patching, should be developed and executed, potentially during scheduled maintenance windows.

Application owners should manage the issue.
Verify external reachability and business criticality.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is EasyAppointments?

EasyAppointments is a web-based scheduling application used by businesses to manage customer appointments and bookings. It provides a digital interface where users can search for and manage client information. The software is built on the CodeIgniter framework and uses MySQL databases to store booking data and customer records, which are the components affected by this vulnerability.

What is the vulnerability in CVE-2025-50455?

This CVE involves a weakness class known as Improper Neutralization of Special Elements used in an SQL Command, or CWE-89. In simpler terms, the application fails to properly clean user input before processing it. By injecting malicious code into the 'order_by' parameter, an attacker can manipulate the application's database queries to extract sensitive data or potentially execute unauthorized commands on the server.

How can an attacker trigger this SQL injection?

An attacker triggers this flaw by sending a specially crafted request to the '/customers/search' endpoint of the application. The vulnerability specifically targets the 'order_by' parameter. It is important to note that this bug is not triggered by standard, legitimate search queries; it requires the injection of specific SQL syntax designed to bypass security filters and force the database to execute unintended commands.

Is my instance of EasyAppointments at risk?

According to Halo Surface Signal, this vulnerability is considered likely to be exposed because it affects a core customer search endpoint. Since these features are typically designed for user access, they are often reachable over the internet. If your EasyAppointments instance is internet-facing, it is more accessible to external actors than a system restricted to an internal, private network.

How should I respond to this threat advisory?

Your first step is to identify all running instances of EasyAppointments within your environment. Prioritize those that are accessible via the internet or contain sensitive business data. Coordinate with your application and infrastructure teams to assess the risk and determine the necessary steps to secure these systems, such as applying pending vendor updates or restricting access to the affected search endpoint until a fix is implemented.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.