CVE-2025-64081 is a Critical severity (CVSS 9.8) SQL injection in SourceCodester Patients Waiting Area Queue Management System v1, in the appointmentID parameter of /php/api_patient_schedule.php. The record lists no fixed version. Treat the product as unpatched: limit who can reach it, switch the query to prepared statements, and check the vendor or project site for an update.
The weakness is catalogued as CWE-89. The Gold page for the CVE is CVE-2025-64081 on Gold.
What's affected
The record names one product and one version:
- SourceCodester Patients Waiting Area Queue Management System v1
- Vulnerable file: /php/api_patient_schedule.php
- Vulnerable parameter: appointmentID
- Fixed version: none listed in the record
This is a small PHP application of the kind often installed from a download site and run as is, so there is usually no package manager entry and no automatic update channel. You need to know that you installed it and where. No account is needed to reach it, according to the CVSS vector.
How to check if you're exposed
Start with inventory. Find out whether Patients Waiting Area Queue Management System is installed on any server you run, including test and demo machines. A search of web roots is a reasonable first pass:
find /var/www -type f -name "api_patient_schedule.php" 2>/dev/null
If the file turns up, open it and read how the query is built. Look for variables from the request being placed straight into a SQL string instead of being passed as bound values:
grep -n "SELECT\|INSERT\|UPDATE\|DELETE" api_patient_schedule.php
grep -n "_GET\|_POST\|_REQUEST" api_patient_schedule.php
If a request value such as appointmentID reaches the SQL text through string concatenation, the code matches the pattern in the record. Also check the database account the app uses and the web server access logs for unusual requests to the named file. The record does not describe indicators, so treat any log review as general hygiene rather than a confirmed detection.
What to do now
- Decide whether the application needs to be internet facing at all. If it does not, move it behind a VPN or an IP allowlist today.
- Check the vendor or project site for a newer release. The record lists no fixed version, so do not assume one exists.
- If you maintain the code, replace string built queries in api_patient_schedule.php with prepared statements and bound parameters, and validate input types.
- Repeat the review on every other file that talks to the database, because the same pattern is likely elsewhere.
- Reduce the database account to the minimum rights the app needs, so a flaw in one query cannot touch everything.
- Run your own scan to find similar issues. Safeguard offers a free in-browser dependency scan for projects that use package managers, and the Gold directory lists records like this one.
Try it yourself
Click through it at your own pace, or open it full screen.
Why it matters
SQL injection happens when input is mixed into a database command in a way that lets the input change the command itself. It is one of the oldest and best understood web flaws, and the fix is also well understood: keep code and data separate with parameterized queries. The record maps the issue to CWE-89, which is the general injection class plus the SQL specific entry.
The record does not say whether exploit details are public, and the CVE is not marked as known exploited. A caution about the label: the VulDB wording calls the issue critical, while the CVSS 3.1 base score of 9.8 sits in the critical band. We use the score for the headline. Your own risk depends on what data sits behind the application.
Quick check
Is CVE-2025-64081 known to be exploited in the wild?
The record does not mark it as listed in the CISA Known Exploited Vulnerabilities catalog, and it gives no report of attacks. Check the advisory sources for updates.
Is there a patched version of Patients Waiting Area Queue Management System?
The record lists no fixed version. Check the vendor or project site, and until you find one, restrict access and fix the query in api_patient_schedule.php yourself if you maintain the code.
Sources
References listed in the CVE record (not independently fetched for this review):
- https://packetstorm.news/files/id/211592
- https://www.sourcecodester.com/php/18348/patients-waiting-area-queue-management-system.html
Last reviewed: 18 October 2026.
