## https://sploitus.com/exploit?id=DF94DDFC-E47F-5A42-8D93-583D2358A2D1
# CVE-2025-50383
# Description
A low-privileged authenticated user can exploit this vulnerability by sending a crafted HTTP POST request with a malicious order_by parameter (e.g., order_by=IF(1=1,SLEEP(5),1)). This can trigger time-based blind SQL injection, resulting in unauthorized SQL execution on the underlying MySQL database and leading to full SQL injection exploitation.
# Affected Endpoints
Exploitable by low-privileged authenticated users (roles: Customers and Providers):
1. /index.php/customers/search
2. /index.php/Unavailabilities/search
3. /index.php/Appointments/search
Exploitable only by Administrator:
1. /index.php/providers/search
2. /index.php/secretaries/search
3. /index.php/admins/search
4. /index.php/service_categories/search
5. /index.php/services/search
6. /index.php/Blocked_periods/search
6. /index.php/Webhooks/search
# Steps to Reproduce
1. Intercept a valid authenticated request to one of the vulnerable endpoints.
2. Add the hidden order_by parameter in the request body.
3. Inject a malicious payload, for example: order_by=IF(1=1,SLEEP(5),1)
4. Send the modified request.
5. The application response is delayed, confirming time-based blind SQL injection.
# Fixed
https://github.com/alextselegidis/easyappointments/releases/tag/1.5.2