CVE-2025-50383: Easy!Appointments SQL injection vulnerability

The vulnerability exists in multiple models within the Easy!Appointments application. The root cause is the improper handling of the order_by parameter in various get() and search() methods. User-supplied input was directly passed to the order_by() clause of the database query, making it possible for an attacker to inject malicious SQL code. The patch addresses this by escaping the order_by parameter using $this->db->escape(), which neutralizes any special SQL characters and prevents the injection. The widespread nature of this flaw across numerous models indicates a pattern of insecure coding practice that was corrected in the patch.