The vulnerability resides in the patient_login.php file of code-projects Doctor Appointment System 1.0. Manipulation of the email parameter allows an attacker to inject arbitrary SQL code. This flaw can be exploited remotely, enabling attackers to bypass authentication, access or modify patient data, and potentially compromise the underlying database. The exploit is available publicly, indicating that attackers can deploy it as part of automated attacks.

Affected is the code-projects Doctor Appointment System version 1.0. The vulnerability targets the patient_login.php component, but the impact extends to any instance where user credentials are validated against a database using user-supplied email input. The system reaches out to a database backend, which could be PostgreSQL, MySQL, or similar, though the specific database is not specified.

The CVSS base score is 6.9, reflecting a medium to high severity due to remote attack potential and notable impact on confidentiality, integrity, and availability. EPSS is not available, and the vulnerability is not listed in CISA KEV. The lack of an EPSS score does not preclude exploitation; the publicly available exploit demonstrates that attackers can manually or automatically target the system. The attack vector is remote, through the email input field in patient_login.php, and requires knowledge of a valid user account or the ability to brute force authentication.