The priyanshumittal Appointment product versions up to 3.5.5 contain a CSRF vulnerability that enables attackers to upload a web shell to the server. This vulnerability requires no privileges and can be triggered remotely with user interaction, leading to complete compromise of the affected system. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality, integrity, and availability. No patch or official remediation is currently documented.

Successful exploitation allows an attacker to upload a web shell, which can lead to full system compromise including unauthorized access, data theft, and disruption of service. The vulnerability affects confidentiality, integrity, and availability of the affected system. No known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should implement CSRF protections such as verifying anti-CSRF tokens, restricting HTTP methods, and limiting user privileges. Monitoring for suspicious upload activity is recommended. Avoid exposing the vulnerable application to untrusted networks if possible.