SourceCodester Patient Appointment Scheduler System version 1.0 contains an RCE vulnerability in the update_settings endpoint located at /scheduler/classes/SystemSettings.php?f=update_settings. The code fails to validate or sanitize input, so a crafted request allows an attacker to execute arbitrary PHP code on the server. This grants the attacker full control over the web application environment, potentially exposing sensitive data, modifying configuration, or disrupting service, thereby compromising confidentiality, integrity, and availability.

The affected product is SourceCodester Patient Appointment Scheduler System version 1.0. The flaw is confined to the SystemSettings update functionality in the web application; no other products or versions have been identified as vulnerable.

The CVSS score of 2.7 denotes low severity; however, the vulnerability is a classic RCE that can be triggered by any user who can send a request to the exposed endpoint, with no authentication required. The EPSS score is below 1%, indicating a low current exploitation probability, and the flaw is not listed in the CISA KEV catalog. Based on the description the attack vector is a remote web request that supplies malicious input to the vulnerable endpoint.