CVE-2025-65358 Details
Description
Edoc-doctor-appointment-system v1.0.1 was discovered to contain SQl injection vulnerability via the 'docid' parameter at /admin/appointment.php.
A SQL injection vulnerability has been identified in the Edoc Doctor Appointment System version 1.0.1. The issue arises in the appointment management feature, specifically within the admin panel. The vulnerability allows authenticated users with admin access to execute arbitrary SQL commands by manipulating the 'docid' parameter in POST requests to the '/admin/appointment.php' endpoint. This exploitation is possible due to improper input validation and the lack of parameterized queries, leaving the application susceptible to SQL injection attacks.
It is recommended to use prepared statements with parameter binding to prevent SQL injection. Server-side validation of input parameters, especially those used in SQL queries, should be implemented. Additionally, the application should avoid direct concatenation of user input into SQL commands. After addressing the vulnerability, a thorough code audit is advised to identify and remediate any similar SQL injection risks.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Dec 3, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/HashenUdara/edoc-doctor-appointment-system | [email protected] | Product |
| https://github.com/omkaryepre/vulnerability-research/tree/main/CVE-2025-65358 | [email protected] | ExploitThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| hashenudara edoc-doctor-appointment-system | 1.0.1 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Dec 3, 2025 | Initial Analysis | [email protected] |
| Dec 3, 2025 | CVE Modified | CISA-ADP |
| Dec 2, 2025 | New CVE Received | [email protected] |