The vulnerability originates in the changebookingstatus.php handler of the Online‑Appointment‑Booking‑System. An attacker can manipulate the payload parameters username[], timestamp[], and status[] to bypass the intended authorization checks, enabling arbitrary status changes to appointments. This flaw allows the attacker to set any booking’s status, potentially canceling, completing, or confirming appointments without legitimate authority.

The affected product is the Online‑Appointment‑Booking‑System developed by girishsaraf. Because the project follows a rolling‑release model, no specific version numbers are disclosed; therefore any instance running before an undisclosed fix remains vulnerable.

The CVSS base score is 6.9, indicating moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The exploit is publicly available and can be performed remotely, requiring only the ability to submit crafted requests. Given the absence of a public patch and the ease of parameter manipulation, attackers are likely to attempt exploitation, resulting in a moderate risk that could lead to unauthorized changes to appointment data.