The Patient Appointment Scheduler System contains a SQL injection flaw in the view_details.php page, which is part of the administrative interface. The vulnerability stems from an unsanitized SQL query that directly interpolates user input into a statement. Based on the description, it is inferred that an attacker could inject arbitrary SQL that would be executed by the database when the page is requested. The potential impact—such as reading, modifying, or deleting appointment data—is also inferred, as the flaw allows manipulation of the SQL command.

This flaw exists in SourceCodester Patient Appointment Scheduler System version 1.0. No other vendor or product variations are listed, and the CVE does not specify additional affected releases beyond that version.

The CVSS base score is 2.7, indicating low severity, and no EPSS score is available. The vulnerability is not included in the CISA Known Exploited Vulnerabilities catalog. Attackers would likely need to reach the authenticated administrative interface to exploit the flaw, possibly by using valid credentials or by leveraging other weaknesses to obtain access. Based on the description, the attack vector is inferred to be a crafted HTTP request to the view_details.php endpoint. The overall risk remains low, but the presence of potential data exposure warrants timely remediation.