Arbitrary code execution has been identified in SourceCodester Patient Appointment Scheduler System version 1.0 via the update_settings function. The flaw allows an attacker to send a crafted request to /scheduler/classes/SystemSettings.php with the parameter f=update_settings and supply arbitrary code, leading to full compromise of the server running the application. This weakness enables an attacker to alter system behavior, exfiltrate data, or install persistent back‑doors.

Patient Appointment Scheduler System version 1.0 developed by SourceCodester. No other versions or vendor details are listed in the vulnerability report.

Because the vulnerable endpoint is reachable over the network, an attacker with network access to the host can exploit the flaw without needing local privileges. The absence of EPSS or KEV data does not diminish the inherent severity; remote code execution poses a high risk of complete system takeover. No mitigation is included in the source code, so the vulnerability remains fully exploitable as long as the endpoint is accessible.