The admin/add-new.php file contains an unknown function that accepts the argument ‘spec’. Unsanitized input to this argument permits attackers to inject arbitrary SQL statements, a classic injection flaw. The vulnerability is classified as CWE‑74 and CWE‑89. If exploited, an attacker can read, modify, or delete database records, potentially exposing sensitive patient information or altering appointment data, and may compromise the overall integrity of the system.

HashenUdara’s e‑doc doctor appointment system is the only product listed as affected. No specific version numbers are available because the software follows a rolling‑release model, making all commits up to cc258425b915d1af9e298777ccd26d160493e68d vulnerable. Thus, any active deployment during that period is at risk until a fixed build is released. The vendor has not responded to notifications, so users must rely on community or vendor‑issued updates.

The CVSS score of 6.9 indicates moderate severity. Because the publicly available exploit can be triggered from outside the network, attackers may perform the injection without authentication, assuming the admin endpoint is reachable. The EPSS score is not available, but the existence of a known exploit suggests a non‑negligible probability of real‑world attacks. The vulnerability is not listed in CISA’s KEV catalog, yet its public availability and lack of a vendor fix elevate the risk.