The Patient Appointment Scheduler System version 1.0 contains a flaw in the manage_user.php script that concatenates user input directly into a SQL query without proper escaping or parameterization. This missing input validation allows attackers to inject arbitrary SQL statements, potentially reading, modifying, or deleting patient and appointment records. The impact on confidentiality and integrity is significant, as sensitive health information is stored in the database.

The vulnerability exists in the SourceCodester Patient Appointment Scheduler System, specifically in the /scheduler/admin/user/manage_user.php endpoint. All installations of version 1.0 that expose this file are affected. No specific CPE strings are listed, and no vendor-specified product hierarchy is available in the data.

No public exploit has been documented and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is not available, but the lack of input validation suggests the vulnerability is highly exploitable, likely via a standard HTTP request to the offending endpoint. Because the attacker can manipulate SQL commands, the security risk is high regardless of current exploitation statistics. The attack vector is inferred to be remote over HTTP/S, and the threat model assumes an attacker with network access to the web application.