CVE-2025-3179 is a High severity (CVSS 7.3) SQL injection in Project Worlds Online Doctor Appointment Booking System 1.0, in the file /doctor/deletepatient.php through the ic parameter. The record lists no fixed version. Treat the application as unpatched, restrict who can reach it, and replace the unsafe query with a parameterized one.
What's affected
The record covers Project Worlds Online Doctor Appointment Booking System version 1.0. The affected file is /doctor/deletepatient.php, and the manipulation of the ic parameter leads to SQL injection. The description says the attack can be started remotely, and that the exploit has been disclosed to the public and may be used. It does not say the flaw is exploited in the wild, and the CVE is not in the CISA KEV list.
The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. In that scoring, no account is needed to reach it. The weaknesses are CWE-74 (injection) and CWE-89 (SQL injection). Impact scores are low in each of confidentiality, integrity and availability, which is why the number stays below Critical.
The record names no fixed version and no vendor patch. The same product has other SQL injection entries from the same series of reports: CVE-2025-3178. If you run this software, fix them all in one pass.
How to check if you're exposed
There is no package to query for this one, because it ships as source code. So the check is about finding the code and reading it. Search your servers and code repositories for the file name:
grep -rIl "deletepatient.php" /var/www 2>/dev/null
find /var/www -name "deletepatient.php" 2>/dev/null
Open each match and trace the ic value to the database call. Concatenation into SQL text is the issue. Also check your access logs for hits on /doctor/deletepatient.php from addresses you do not recognize, and check whether a login is required before the page runs its query.
If the application is on an internal network only, note who can reach it. Internal does not mean safe if staff devices or contractors can browse to it.
What to do now
- Check the vendor's site and the public report for a patched release. The record names none, so do not assume one exists.
- Take the application off the public internet, or put it behind a VPN, an IP allowlist or HTTP authentication until the code is fixed.
- Rewrite the query that uses the
icparameter in/doctor/deletepatient.phpto use prepared statements with bound values. Example:
$stmt = $con->prepare("SELECT * FROM records WHERE id = ?");
$stmt->bind_param("i", $id);
$stmt->execute();
$result = $stmt->get_result();
That is an illustration for a PHP and MySQL stack, with a stand in table name. Use the right type letter for each value, and apply the same change to every query in the file, not only the one named in the record. 4. Run the application's database account with the least privileges it needs. It should not own the schema or be able to read other databases. 5. Review access logs and database contents for signs of misuse, and rotate any credentials stored in the database if you see any.
Why it matters
Look at the shape of the flaw. A value arrives in a request, reaches a query without being bound as a parameter, and the database treats it as part of the command. That is CWE-74 at the general level and CWE-89 for SQL specifically.
The fix is not clever. Use prepared statements with bound parameters for every query, validate the type of each input, and give the database account only the rights it needs. Source code projects of this kind are often downloaded as starting points or learning material, then deployed with little change. If that describes your Online Doctor Appointment Booking System installation, you own its security from the first day, and a code review for string built queries is the right next step.
A practical point for defenders: the record says a public exploit exists, so scanners and curious visitors can find the page fast. Even though the CVSS score is only 7.3, an internet facing page that talks to a database with customer or patient style records deserves the same care as a higher scored bug.
Quick check
Is there a patched version of Online Doctor Appointment Booking System?
The record lists no fixed version. Check the vendor's site and the public report, and if nothing is published, fix the query in /doctor/deletepatient.php yourself or take the application out of service.
Does a firewall rule fix this?
It reduces exposure, but the flaw stays in the code. A web application firewall can block some probes. The real fix is a parameterized query in /doctor/deletepatient.php.
Sources
Last reviewed: 19 October 2026.
