The Simple Doctors Appointment System has an issue in its category‑save endpoint (/doctors_appointment/admin/ajax.php?action=save_category) where the img parameter is stored without proper validation or filtering. An attacker can supply any file and the system will store it, allowing upload of executable or web script files. This undermines file‑type security controls and can enable remote code execution if the uploaded file is then accessed via the web, leading to compromise of application confidentiality, integrity, and availability.

The vulnerability affects SourceCodester’s Simple Doctors Appointment System, any release version up to and including 1.0. No later versions have been reported as affected, and the issue resides specifically in the ajax.php script used for category creation.

The CVSS base score of 5.3 indicates moderate severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. The attack vector can be performed from a remote network through an HTTP POST containing a crafted image field. Once a file is uploaded, if the web server allows execution of that file type, an attacker can achieve remote code execution. The lack of server‑side restrictions means the condition for exploitation is minimal: simply contacting the endpoint with a malicious payload. This represents a clear and actionable risk in environments where the application is exposed to the internet.