An unknown function within the admin/doctor_action.php file allows an attacker to manipulate the ID parameter, creating an SQL injection vulnerability. This flaw permits the execution of arbitrary SQL statements against the database, potentially revealing, altering, or deleting sensitive data. The weakness corresponds to parameter handling flaws and lack of input validation.

The vulnerability affects the Online Doctor Appointment System produced by itsourcecode. All installations of version 1.0 are vulnerable, as the issue resides in a universally present script in the specified web application.

The CVSS score of 6.9 places the issue in the medium severity range. Exploit probability is low, with an EPSS score below 1 percent, and the vulnerability is not listed in the CISA KEV catalog. Inferred from the description, the attack vector is remote over the network, leveraging publicly available exploit code to submit malicious requests directly to the vulnerable endpoint.