SourceCodester Patients Waiting Area Queue Management System 1.0 contains a SQL injection vulnerability in the getPatientAppointment function within /php/api_patient_checkin.php. This vulnerability allows remote attackers to manipulate the appointmentID parameter to execute SQL injection attacks. Public exploit code is available, and the vulnerability has a high severity rating with a CVSS score of 7.3.