We are getting close to releasing BugBountyHunter v2 which will introduce a brand new website, including member platforms, new features, challenges, guides, videos, and the long awaited zseano methodology v2. Right now, all of the content on this website is considered out-dated, however our members section continues to operate for members.
Stay tuned for updates coming soon!
FirstBlood-#1368 — Can change the data of the cancelled Appointments
This issue was discovered on FirstBlood v3
On 2022-12-09, mr_xhunt 
Level 8
reported:
Getting started
Learn about vulnerability types 
Getting started in bug bounties 
Test your knowledge
Free Web Application Challenges
Guides for your hunts 
ZSeano's Methodology
Effective Note Taking for bug bounties
Useful Resources 
Disclosed HackerOne Reports 
Our community
Endorsed Members
Hackevents 
Member Articles
Summary:
Although this is not a Security Issue but
After Cancelling the Appointments, again visiting the api to cancel works successfully and If we change the name & DOB it is also reflected their.
Steps To Reproduce:
- Create an Appointment and Then cancel it and record it in Burp
- Cancelled POC
- Now again send the Cancel request with the Api but this time change the
name &dob headers value
- POC : Data got altered even though it was cancelled
P4 Low
Endpoint: /manageappointment.php
Parameter: *
Payload: *
FirstBlood ID: 49
Vulnerability Type: Application/Business Logic
Users can modify their name/dob via the header parameters on modify-appointment.php despite this being restricted on the web application