BugBountyHunter

after navigating through the web-app we learn that a patient can book his appointment and get a unique random ID for it. This random ID is unguessable. after we create an appointment we notice that the patient can modify his appointment or even cancel it. this is the image for creating an appointment

this is the image for cancelling an appointment

now after we login using the Dradmin credentials and enter the drpanel we can view the appointments and the cancelled ones as well, but we cannot cancel patient's appointment or (can we ? ) . we notice that when we click on a patient's name we get a popup with the details of that patient's appointment; but because we are curious and we like to know what's happening behind the scenes we open up inspector element and check what's happening.

and the getinfo(number) gets our attention , there's a number and diving deeper into it we find that the getinfo function is actually using the drapi/query.php?aptid='aptid', and the normal user is using the /api/qa.php api to retrieve his appointment id details now what if we insert the id from the Drpanel into the normal retrieve appointment screen

it tells us that it's invalid, but what if we enter it inside the qa.php API

now we get the original ID the patient gets when booking his appointment

now we take that id (the long string) and enter it inside the retrieve app or through the ma.php API and cancel the appointment

and that's how a doctor can cancel patient's appointments.