CVE-2025-3178 is a High severity (CVSS 7.3) SQL injection in Project Worlds Online Doctor Appointment Booking System 1.0, in the file /doctor/deleteappointment.php through the ID parameter. The record lists no fixed version. Treat the application as unpatched, restrict who can reach it, and replace the unsafe query with a parameterized one.
What's affected
The record covers Project Worlds Online Doctor Appointment Booking System version 1.0. The affected file is /doctor/deleteappointment.php, and the manipulation of the ID parameter leads to SQL injection. The description says the attack can be started remotely, and that the exploit has been disclosed to the public and may be used. It does not say the flaw is exploited in the wild, and the CVE is not in the CISA KEV list.
The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. In that scoring, no account is needed to reach it. The weaknesses are CWE-74 (injection) and CWE-89 (SQL injection). Impact scores are low in each of confidentiality, integrity and availability, which is why the number stays below Critical.
The record names no fixed version and no vendor patch. The same product has other SQL injection entries from the same series of reports: CVE-2025-3179. If you run this software, fix them all in one pass.
How to check if you're exposed
You can confirm exposure in three quick steps. First, locate the application and note its version, which should be 1.0 if it matches the record. Second, find the vulnerable script:
find /var/www -name "deleteappointment.php" 2>/dev/null
Third, read it. Look for code that places the ID value inside the SQL text instead of binding it. If you see that, assume the flaw is present regardless of what the version string says, since the record lists no patch.
If you run a web application firewall or reverse proxy, look at its logs for requests to /doctor/deleteappointment.php that were blocked or flagged. If you have no logging in front of the app, turn on access logging now so you can see future probes.
What to do now
- Check the vendor's site and the public report for a patched release. The record names none, so do not assume one exists.
- Take the application off the public internet, or put it behind a VPN, an IP allowlist or HTTP authentication until the code is fixed.
- Rewrite the query that uses the
IDparameter in/doctor/deleteappointment.phpto use prepared statements with bound values. Example:
$stmt = $con->prepare("SELECT * FROM records WHERE id = ?");
$stmt->bind_param("i", $id);
$stmt->execute();
$result = $stmt->get_result();
That is an illustration for a PHP and MySQL stack, with a stand in table name. Use the right type letter for each value, and apply the same change to every query in the file, not only the one named in the record. 4. Run the application's database account with the least privileges it needs. It should not own the schema or be able to read other databases. 5. Review access logs and database contents for signs of misuse, and rotate any credentials stored in the database if you see any.
Why it matters
The reason these entries keep arriving is simple: it is easy to write a query by gluing text together, and it works in testing. The mistake only shows up when someone supplies a value the author did not expect. This CVE is classified under CWE-74 and CWE-89.
The fix is not clever. Use prepared statements with bound parameters for every query, validate the type of each input, and give the database account only the rights it needs. Source code projects of this kind are often downloaded as starting points or learning material, then deployed with little change. If that describes your Online Doctor Appointment Booking System installation, you own its security from the first day, and a code review for string built queries is the right next step.
A practical point for defenders: the record says a public exploit exists, so scanners and curious visitors can find the page fast. Even though the CVSS score is only 7.3, an internet facing page that talks to a database with customer or patient style records deserves the same care as a higher scored bug.
Quick check
Is there a patched version of Online Doctor Appointment Booking System?
The record lists no fixed version. Check the vendor's site and the public report, and if nothing is published, fix the query in /doctor/deleteappointment.php yourself or take the application out of service.
Does the application need to be removed?
Not necessarily. If you cannot fix the code, limit who can reach it with a VPN, an IP allowlist or authentication, and use a least privilege database account.
Sources
Last reviewed: 19 October 2026.
