The flaw exists in the Username field of /admin/login.php. An attacker can inject arbitrary SQL that is executed by the backend without proper sanitization, allowing bypass of authentication and unauthorized read, alteration or deletion of appointment records and other confidential data stored in the database.

SourceCodester Simple Doctors Appointment System version 1.0 runs on web servers that expose the /admin/login.php endpoint to external clients. The vulnerability affects that specific module of the application.

The CVSS base score of 6.9 indicates a moderate risk level. The EPSS score is not available and it is not listed in the CISA KEV, suggesting no widespread exploitation has been confirmed yet. However, the publicly available exploit code implies that automated scanners could discover and target this flaw from any network, and attackers would only need to send crafted HTTP requests to trigger the injection. Based on the description that the exploit is public, it is inferred that automated scanners could detect and exploit this flaw from any network.