External risk intelligence

SQL Injection in Patients Waiting Area Queue Management System AppointmentID Parameter.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-64081

The vulnerability exists in a web-based management system designed to handle patient queues. Such applications are typically deployed as web services intended to be accessible to staff and potentially patients via a network interface, making them commonly reachable in the environments where they are deployed.

SQL Injection

Pamzey Patients Waiting Area Queue Management System

1.0

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical SQL injection vulnerability found in a patient queue management system. The issue allows unauthorized execution of database commands, potentially impacting data integrity and system availability. The main concern is confirming relevance and exposure within our environment.

Database commands can be run remotely.
Critical patient data could be compromised.
Confirm system usage and verify exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a specially crafted request to the web-based patient scheduling system. No authentication is required, and the attacker can target the `/php/api_patient_schedule.php` endpoint. By manipulating the `appointmentID` parameter, they can inject malicious SQL commands, leading to the execution of arbitrary SQL code.

Accessible via the network.
Triggered by manipulating appointment ID.
Leads to arbitrary SQL command execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to inject and execute arbitrary SQL commands by manipulating the `appointmentID` parameter in the `/php/api_patient_schedule.php` script. This could lead to unauthorized access to or modification of sensitive patient scheduling data, depending on the system's configuration and database permissions.

Patient scheduling data at risk.
Exploited via a network request parameter.
May lead to unauthorized data access.

Operational Fix

Recommended remediation, mitigation, and detection steps

This SQL injection vulnerability affects the SourceCodester Patients Waiting Area Queue Management System. The application owner, in coordination with the infrastructure or platform team, should prioritize identifying all instances of this system. Confirming network reachability and business criticality will inform the urgency of remediation and the assignment of accountability.

Application owner responsible for remediation.
Verify system network exposure and criticality.
Plan and execute risk-based remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Patients Waiting Area Queue Management System?

It is a web-based application designed to organize and manage patient flow in clinical or administrative settings. Organizations use this system to track patient appointments and handle queues efficiently. Developed by pamzey and hosted on platforms like SourceCodester, it acts as a central hub for scheduling data, typically interacting directly with a backend database to store and retrieve patient information.

How does CVE-2025-64081 enable SQL injection?

This vulnerability is classified as CWE-89, or Improper Neutralization of Special Elements used in an SQL Command. It occurs when the software does not properly sanitize user input before including it in a database query. In this specific case, the application fails to validate the appointmentID parameter, allowing an attacker to insert their own SQL commands, which the database then executes as if they were legitimate instructions.

Do I need to be logged in to trigger this vulnerability?

No, authentication is not required to trigger the vulnerability. An attacker can execute the attack by sending a malicious network request directly to the /php/api_patient_schedule.php file. The issue is specific to the handling of the appointmentID parameter; requests that do not target this specific endpoint or do not manipulate this parameter do not initiate the flaw.

Is my system at risk if it is internal?

Halo Surface Signal notes that while this system is often deployed as a web service for staff, any network reachability increases risk. Even internal systems are susceptible if an attacker has gained a foothold on your local network. You should treat any instance of this software as potentially reachable if it is connected to a network that allows traffic to the management interface.

What steps should I take if I use this software?

First, locate all running instances of the Patients Waiting Area Queue Management System within your environment to understand your total footprint. Once identified, evaluate the network accessibility of these systems to determine the urgency of your response. Coordinate with your application owners to confirm business criticality, plan for necessary updates, or restrict access to the affected endpoint to prevent unauthorized database commands.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.