A SQL injection flaw exists in the /admin/appointment_action.php module of the Online Doctor Appointment System. By manipulating the appointment_id parameter, an attacker can inject arbitrary SQL commands that the database will execute. This can expose, alter, or delete sensitive appointment and patient data. The weakness is categorized as CWE‑74 (Improper Handling of Input) and CWE‑89 (Improper Neutralization of Special Elements used in an SQL Command).

The vulnerability affects the Online Doctor Appointment System developed by itsourcecode, specifically version 1.0. No other variants or releases are listed as impacted.

The CVSS score of 5.1 indicates a medium severity, but the EPSS score of less than 1% suggests a low likelihood of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog, implying it has not been observed in known, actively exploited attacks. Because the attack can be launched remotely through the public web interface, an attacker who discovers the flaw can exploit it without needing privileged credentials or local access. The available public exploit code further raises the potential for automated attacks. Organizations running the affected version should treat this as a medium‑risk threat that could enable data leakage or tampering if left unmitigated.