External risk intelligence

Edoc Doctor Appointment System SQL Injection Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-65358

The vulnerability exists in a doctor appointment system, which is typically deployed as a web application intended to be accessed by users over the internet for scheduling purposes. As a web-based service providing booking functionality, it is commonly exposed to the public internet.

SQL Injection

Hashenudara Edoc Doctor Appointment System

1.0.1

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in an electronic doctor appointment system that allows for SQL injection. This means an attacker could potentially access or manipulate sensitive appointment and patient data by exploiting weaknesses in how the system handles specific commands. The primary concern is to determine if this type of system is in use and if it is exposed to potential threats.

The system can be tricked into revealing or altering data.
It affects systems used for scheduling medical appointments.
Confirm relevance and exposure within our environment.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted request to the affected web application. This request would target the 'docid' parameter in the /admin/appointment.php file. If successful, the attacker could manipulate database queries, potentially leading to unauthorized access to sensitive information or disruption of the system.

No authentication or user interaction needed.
Exploited via the 'docid' parameter.
Full database compromise possible.

Live Threat

Current exploitation, exposure, and threat context

The 'docid' parameter in the Edoc doctor appointment system, when accessed via its web interface, could be exploited through SQL injection. This could allow an unauthenticated attacker to manipulate database queries, potentially leading to unauthorized access to or modification of sensitive information within the system.

Patient appointment data could be exposed.
Database queries could be altered remotely.
Unauthorized access to sensitive records.

Operational Fix

Recommended remediation, mitigation, and detection steps

The edoc-doctor-appointment-system, being a web application, likely falls under the purview of application owners or platform teams responsible for its deployment and operation. The initial step for these teams is to identify all instances of this system within their environment, assess their exposure and criticality, and then locate the accountable owner for prompt remediation planning.

Application owners should lead remediation efforts.
Verify system accessibility and business criticality first.
Plan remediation based on identified exposure.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Edoc doctor appointment system?

The Edoc doctor appointment system (v1.0.1) is a web-based application designed to manage and schedule medical appointments. It provides a digital interface for patients and administrators to interact with appointment data, typically facilitating booking workflows and record management within a healthcare or clinical setting.

What does SQL injection mean for CVE-2025-65358?

This vulnerability is classified as CWE-89, which refers to Improper Neutralization of Special Elements used in an SQL Command. In plain terms, the software fails to properly filter the input it receives from users. Because of this, an attacker can input malicious commands that the system's database then executes, potentially allowing unauthorized access to or modification of the underlying patient and appointment data.

How is this SQL injection vulnerability triggered?

An attacker triggers this flaw by sending a specially crafted web request containing malicious data to the 'docid' parameter located in the '/admin/appointment.php' file. No authentication or user interaction is required to initiate this request. Simply visiting the administrative page without sending this specific parameter-based payload does not trigger the vulnerability.

Why should I care about this vulnerability?

According to Halo Surface Signal, this software is typically deployed as a web application intended for public internet access to support appointment scheduling. Because it is often exposed to the public internet, the potential for unauthorized remote access to your database and sensitive patient records is high, making it a critical concern for any organization running this platform.

What should I do if I run this system?

The first step is for application owners to inventory their environment to locate all instances of the Edoc doctor appointment system. Once identified, evaluate the system's business criticality and network accessibility to determine the level of risk. Coordinate with your platform teams to prioritize this application for remediation planning and track progress until the vulnerability is addressed.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.