This vulnerability allows an attacker to upload files without restriction by manipulating the img parameter in the specified PHP script of the Simple Doctors Appointment System version 1.0. The attack vector is remote network access with no required privileges or user interaction. The CVSS 4.0 base score is 5.3 (medium), reflecting the ease of exploitation and potential impact. The vulnerability is publicly disclosed, but no vendor patch or fix information is currently available.

Successful exploitation could allow an attacker to upload arbitrary files to the server, potentially leading to further compromise depending on the server configuration and file handling. The vulnerability affects version 1.0 of the product. There are no confirmed reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable endpoint and implement file upload validation controls if possible. Monitor for updates from the vendor regarding patches or official mitigations.