Critical · published December 8, 2025
🚨 A single SQL injection flaw in SourceCodester's Patients Waiting Area Queue Management System lets attackers run arbitrary SQL commands through a simple appointment ID — talk about a recipe for disaster! 🔥 This is like a restaurant that lets diners change their orders without checking — a crafty customer could swap out their meal for the chef's secret ingredient list! 🥘 An attacker could exploit this vulnerability to gain complete control over the database, potentially accessing sensitive patient data, altering records, or even deleting entire tables. This poses an absolute risk to patient privacy and the integrity of the entire system.
This is like a restaurant that lets diners change their orders without checking — a crafty customer could swap out their meal for the chef's secret ingredient list! 🥘 The SQL injection vulnerability in /php/api_patient_schedule.php allows attackers to manipulate the appointmentID parameter, enabling them to execute arbitrary SQL commands without any user authentication.
An attacker could exploit this vulnerability to gain complete control over the database, potentially accessing sensitive patient data, altering records, or even deleting entire tables. This poses an absolute risk to patient privacy and the integrity of the entire system. Immediately patch your system to the latest version of SourceCodester's Patients Waiting Area Queue Management System. Implement input validation for the appointmentID parameter and consider using prepared statements to secure database interactions. This is fixable! Act quickly, and you'll keep your database safe and sound. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| pamzey/patients_waiting_area_queue_management_system | all versions | — |