Paper/Archive/CVE-2025-7751

CVE-2025-7751

code-projects Online Appointment Booking System — code-projects Online Appointment Booking System addclinic.php sql injection

EPSS 0.5%public exploit CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 41.9.419 × 208.4 Exploit: SSVC poc+1010.0 SSVC exploitation: poc+100.0

Description · from the CVE record

A vulnerability has been found in code-projects Online Appointment Booking System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/addclinic.php. The manipulation of the argument cid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Affected

ProductAffectedFixed inSource

Online Appointment Booking System1.0–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

VulDB (CNA)7.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

VulDB (CNA)7.3CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

VulDB (CNA)6.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

writeupvuldb.com/?id.316741 refvuldb.com/?ctiid.316741 writeupvuldb.com/?submit.615492 exploitgithub.com/zzb1388/cve/issues/24 refcode-projects.org