CVE-2025-7515 is a high severity SQL injection flaw (CVSS 7.3) in code-projects Online Appointment Booking System version 1.0, reached through the doctorname argument of /ulocateus.php. The record names no patched release, so the fix is to correct the code, restrict access to the app, or retire it.
What's affected
The record names code-projects Online Appointment Booking System, version 1.0. The weak spot is the doctorname argument handled by the file /ulocateus.php. The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. In plain terms: reachable over the network, low attack complexity, no privileges and no user interaction needed, and a low impact on each of confidentiality, integrity and availability, for a base score of 7.3.
The NVD description calls the issue critical, which is the wording VulDB uses for this family of reports. The CVSS base score of 7.3 falls in the High band, so this post uses High. If your own scoring treats a public database injection as critical because of what the database holds, that is a fair local call.
No fixed version appears in the record or its references. Treat every copy of version 1.0 as affected until you have confirmed otherwise with the vendor. The record says the exploit has been disclosed to the public. It does not say the flaw is exploited in the wild, and it is not on the CISA Known Exploited Vulnerabilities list. Public detail still lowers the effort needed to try it, so do not wait on that distinction.
How to check if you're exposed
First find out whether you run the product at all. Search web roots and repositories for the file named in the record.
find /var/www -type f -name "ulocateus.php" -path "*.*"
Then open the file and look at how doctorname reaches the database. A query built by joining text together with request data is the pattern to look for.
grep -n "_GET\|_POST\|_REQUEST\|mysqli_query\|->query(" /path/to/ulocateus.php
Finally, check web server logs for requests to /ulocateus.php with unusual characters in doctorname, such as stray quotes or SQL keywords. A hit does not prove a breach, but it tells you whether anyone has probed the page.
If you cannot find the product, run a free scan of your repositories and manifests at gold.safeguard.sh/scan. It reports known CVEs for the dependencies it can see. A hand-written PHP project may not appear in a package inventory, so a file search on the server is the more reliable check here.
What to do now
- Find every copy of code-projects Online Appointment Booking System you run, including test and demo servers, and note which ones face the internet.
- Take internet-facing copies offline, or put them behind a VPN, a login proxy or an IP allow list until the code is fixed.
- Change the query behind /ulocateus.php so
doctornameis passed as a bound parameter in a prepared statement, never joined into the SQL text. Validate its type and length too. - Review the other pages in the app for the same pattern. Apps of this kind repeat one query style, and several sibling CVEs exist for the same product family.
- Give the database account the app uses only the rights it needs. It should not own the schema or hold file or admin privileges.
- Watch the vendor site and the NVD record for a fix. If the product is a sample or abandoned project, plan to replace it, and check the advisory before relying on any claim of a patch.
- Rescan after changes and add the app to a recurring check so a regression is caught.
Why it matters
The weakness here is CWE-89, a child of CWE-74. Request input ends up inside a SQL statement as text, so the database cannot separate what the developer wrote from what a visitor sent.
The record lists no privilege requirement, so the page may be reachable by any visitor who can reach the site. The fix pattern is old and well understood. Prepared statements keep the SQL text fixed and send values separately, which removes the problem at the source. Escaping by hand misses cases, so use it only as a second layer.
Quick check
Is there a patched version of Online Appointment Booking System?
The record and its references do not name one. Check the vendor site and the advisory before assuming there is, and fix the code yourself if you must keep running it.
Is a web application firewall enough?
It can reduce noise and block common patterns, but it is a stopgap. The durable fix is parameterized queries in the code.
Sources
The other references in the record are public researcher write-ups and database entries. This post does not reproduce them and gives no attack steps.
Last reviewed: 18 October 2026.
