Correction to title --> THE API IS ACCESSIBLE BY ANYONE

Summary

In the source code of /drpanel/index.php there is the following code snippet:

/* to do
 function editpassword(username) {
 var xhr = new XMLHttpRequest();
 xhr.open("POST", '', true);
 xhr.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");

 xhr.onreadystatechange = function() {
     if (this.readyState === XMLHttpRequest.DONE && this.status === 200) {
         alert(this.responseText);
         } else {

         }
     }

 xhr.send();
 } */

Which suggests that there is a function to edit the password of accounts,however the endpoint is not shown to us not even if we're admin(tested after I logged in as admin user).Through absolute guessing on the first try I found the endpoint /drpanel/drapi/editpassword.php which was returning blank,changing it to POST and adding the parameter username as the code suggests,it successfully changed the password of the user drAdmin.

Steps to reproduce

1. Make a POST request to /drpanel/drapi/editpassword.php with the POST parameter username=drAdmin
2. The server will respond with the new password of the user

Impact

ANY USER is able to update the password of any doctor/admin if their username is known which leads to the takeover of their account and if they're admin for example drAdmin,they get full access as admin.

Request PoC(notice there's NO cookies set) -->