Overview

A critical vulnerability, CVE-2025-3184, has been discovered in the projectworlds Online Doctor Appointment Booking System 1.0. This flaw affects a yet-unknown process linked to the file /patient/profile.php?patientId=1, making the system susceptible to SQL Injection attacks. The vulnerability has been publicly disclosed, potentially allowing attackers to compromise the system and leak sensitive data remotely.

Vulnerability Summary

CVE ID: CVE-2025-3184
Severity: Critical, CVSS 7.3
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: Potential system compromise and data leakage

Affected Products

Product | Affected Versions

Online Doctor Appointment Booking System | 1.0

How the Exploit Works

The vulnerability lies in the improper handling of user-supplied data in the patientFirstName parameter for the /patient/profile.php?patientId=1 file. An attacker can manipulate this parameter to execute arbitrary SQL commands in the system’s database. This exploitation allows the attacker to modify, delete, or extract sensitive data, leading to a potential system compromise.

Conceptual Example Code

Here is a simple conceptual example of how this vulnerability could be exploited:

GET /patient/profile.php?patientId=1&patientFirstName=validName'; DROP TABLE patients; -- HTTP/1.1
Host: target.example.com

In this example, the attacker manipulates the patientFirstName parameter to inject a SQL command (`DROP TABLE patients;`) into the system’s database.

Mitigation

The best mitigation strategy is to apply the vendor’s patch once it becomes available. Until then, using a Web Application Firewall (WAF) or Intrusion Detection System (IDS) can help to identify and block potential SQL injection attacks. Additionally, it is recommended to sanitize all user-supplied inputs to prevent the execution of arbitrary SQL commands.