SourceCodester Simple Doctors Appointment System 1.0 contains a SQL injection vulnerability in the /admin/ajax.php endpoint when the action parameter is set to set_appointment. The vulnerability arises from improper sanitization of the ID argument, allowing an attacker to inject arbitrary SQL commands remotely. Exploit code has been publicly disclosed. There is no official remediation or patch currently documented.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries on the backend database. This may lead to unauthorized data access, modification, or deletion. Since the attack vector is remote and does not require authentication, the system is exposed to potentially serious data compromise or disruption of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to restrict access to the vulnerable endpoint, apply web application firewall rules to detect and block SQL injection attempts, and review input validation and sanitization on the affected parameter.