SourceCodester Simple Doctors Appointment System 1.0 contains an SQL injection vulnerability in the /admin/login.php script. The vulnerability arises from improper sanitization of the Username input parameter, which can be exploited remotely without authentication. The CVSS 4.0 base score is 6.9, indicating a medium severity impact with network attack vector, low complexity, no privileges required, and no user interaction needed. The vulnerability allows attackers to manipulate SQL queries, potentially leading to unauthorized data access or modification. No vendor patch or official fix has been disclosed, and no known exploits in the wild have been reported yet.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database of the affected application. This may lead to unauthorized access to sensitive data, data modification, or disruption of application functionality. Since the vulnerability is remotely exploitable without authentication, it poses a significant risk to affected systems. However, the overall severity is medium due to limited complexity and partial impact metrics.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to implement input validation and sanitization on the Username parameter to prevent SQL injection. Additionally, consider deploying web application firewalls (WAFs) with SQL injection detection rules to mitigate exploitation attempts. Monitor for any vendor updates or patches addressing this vulnerability.