CVE-2025-3186: A vulnerability was found in projectworlds Online Doctor Appointment Booking System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /pa...

Summary

A vulnerability was found in projectworlds Online Doctor Appointment Booking System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /patient/invoice.php. The manipulation of the argument appid leads to sql injection. The attack can be lau...

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
projectworlds	online_doctor_appointment_booking_system_php_and_mysql	1.0 `cpe:2.3:a:projectworlds:online_doctor_appointment_booking_system_php_and_mysql:1.0:::::::*`

Original advisory text

A vulnerability was found in projectworlds Online Doctor Appointment Booking System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /pa...

A vulnerability was found in projectworlds Online Doctor Appointment Booking System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /patient/invoice.php. The manipulation of the argument appid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

References

https://vuldb.com/?ctiid.303145 Permissions Required VDB Entry
https://vuldb.com/?id.303145 Third Party Advisory VDB Entry
https://vuldb.com/?submit.543846 Third Party Advisory VDB Entry
https://github.com/p1026/CVE/issues/20 Exploit Issue Tracking Third Party Advisory