A SQL injection weakness exists in the admin/ajax.php endpoint of SourceCodester Simple Doctors Appointment System 1.0 when the ID parameter is manipulated. The flaw allows a malicious actor to inject arbitrary SQL statements, potentially reading, modifying, or deleting sensitive data stored in the database. The root cause derives from insufficient input validation and inadequate use of parameterized queries (CWE‑74 and CWE‑89).

The affected product is SourceCodester Simple Doctors Appointment System, specifically version 1.0, deployed under the /admin/ajax.php?action=set_appointment path.

The vulnerability carries a CVSS score of 6.9 and is known to be exploitable remotely, as the description indicates a remote attack can be initiated. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can target the web interface to insert malicious SQL via the ID argument; no additional prior authentication or privileges are asserted in the public description. The moderate severity score reflects the potential for data compromise or unwarranted system changes.