A critical SQL injection vulnerability in EasyAppointments allows unauthenticated attackers to extract database data and potentially execute arbitrary code.

This is a SQL injection vulnerability located in the order_by parameter of the /customers/search endpoint. An unauthenticated attacker can manipulate this parameter to perform schema enumeration or, under specific configurations, write a PHP shell to the server.

The ability to perform SQL injection and potential remote code execution represents a critical risk to the confidentiality and integrity of the application. An attacker could gain full control over the database and the underlying server, leading to significant data breaches and unauthorized system access.

Immediate Action: Update EasyAppointments to the latest available version that addresses this SQL injection flaw.

Proactive Monitoring: Monitor web server access logs for suspicious input in the order_by parameter and look for attempts to access or write files with .php extensions.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns specifically targeting order_by parameters.

Public Exploit Available: Yes (a public proof-of-concept exists via threatlance-org GitHub repository).

The presence of a public proof-of-concept significantly lowers the barrier for exploitation. Administrators should apply the update immediately and audit their environments for any signs of unauthorized file creation or abnormal database query activity.