The vulnerability is an unsanitized input that permits arbitrary SQL execution in the admin view of appointments. An attacker could read, modify, or delete patient records, appointment schedules, and other sensitive data. This flaw maps to improper input validation (CWE‑89) and results in confidentiality and integrity violations.

The affected application is the SourceCodester Patient Appointment Scheduler System, version 1.0. The flaw resides in /scheduler/admin/appointments/view_details.php, a file used by the administrative interface typically accessed by authorized personnel.

The risk level is high because the injection is unrestricted; an attacker can exploit the flaw via the web interface by sending crafted parameters or form data. While no specific exploitation metrics are published, the absence of mitigation indicates a moderate to high likelihood of attack. Immediate remediation is recommended.