A vulnerability exists in the Booking Handler’s patappointtime.php of the subhajitkhan online‑clinic‑management‑system. The code fails to enforce required authorization checks, allowing an attacker to manipulate appointment requests arbitrarily. Because the workflow enforcement is bypassed, an attacker can create, modify, or cancel appointments without proper consent, resulting in integrity violations and potential disruption of clinic operations.

The affected system is the subhajitkhan online‑clinic‑management‑system, a GitHub‑hosted PHP application. Versions up to and including the commit hash e9ee77a8827a1446220fa07ee693dc4d9a29a578 are vulnerable; the flaw resides in the patappointtime.php file of the Booking component.

The base CVSS score of 5.3 indicates moderate severity, reflecting a remote attack vector but no guaranteed code execution. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting early‑stage exploitation risk. Attackers can reach the vulnerable script over the web; however, no public exploits are reported, and the repository maintainer has not yet addressed the issue, increasing uncertainty about remediation.