The flaw is an unsanitized order_by parameter in the /customers/search endpoint of Alex Tselegidis EasyAppointments (versions up to 1.5.1). An attacker can inject arbitrary SQL via this parameter, enabling time‑based queries, schema enumeration, and, if MySQL configuration allows, writing a PHP shell through INTO OUTFILE to achieve remote code execution. This represents a classic SQL injection (CWE‑89) with severe impact.

Any deployment of Alex Tselegidis EasyAppointments running version 1.5.1 or earlier is potentially affected.

The vulnerability carries a CVSS score of 9.1, indicating critical severity, and is not listed in CISA KEV. EPSS score is < 1%, indicating a very low probability of exploitation. The lack of access controls to the endpoint suggests that a remote attacker could exploit the flaw by sending crafted HTTP requests. If the underlying MySQL instance permits the INTO OUTFILE command, the attacker can create a PHP shell on the web server, giving full remote code execution. Absent that configuration, the attacker still gains the ability to perform unauthorized data extraction and enumeration.