BugBountyHunter

Hi there

I found it is possible to delete a ambulance from an appointment via a api call to /api/manageambulances.php

To reproduce :

1. Visit firstbloodhackers.com/book-appointment.php and fill in the information required to make an appointment
2. Click Book Appointment and intercept the request
3. Add &ambulance=1 to the data and forward the request

4. Take note of the created appointment ID

5. Visit firstbloodhackers.com/api/ambulances.php?select={appointment ID} and take note of the ambId

6. Visit firstbloodhackers.com/api/manageambulances.php?ambId={ambId} and intercept the request
7. Change the request to a DELETE request and forward the request

The ambulance has now been deleted from the appointment. We can check this by visiting firstbloodhackers.com/ambulance.php?apptId={appointment ID} or by making a call to /api/ambulances.php