FirstBlood-#1399It is possible to book an appointment with an unavailable doctor
This issue was discovered on FirstBlood v3

On 2022-12-09, 0xblackbird Level 5 reported:



It appeared to me that there are no checks on the backend regarding whether a doctor is available or not. This allows anyone to book an unavailable doctor at any time.

Possible cause:

I suspect that the developers thought that, as there was no way to specify a doctor's ID (using the web UI), it shouldn't be possible to select an unavailable doctor. These kinds of underestimations are made a lot during development.


I'm able to make an appointment with an unavailable doctor. This can cause inconvenience and misunderstanding among the management team.

Steps to reproduce:

1) Visit /book-appointment.php#doctor=1 (ID 1 is by default unavailable). 2) Fill in the form and submit it. 3) As you can see below, our appointment was made successfully:

4) To cross-check this, we could visit /manageappointment.php?success&aptid={GUID}, this would return back our previously selected doctor:


I recommend placing a check on the backend to see if the doctor is available. If not, the request must be rejected (or another doctor must be assigned).

Have a nice day!

Kind regards,


P4 Low

Endpoint: /api/ba.php

Parameter: drId

Payload: 1

FirstBlood ID: 67
Vulnerability Type: Application/Business Logic

It is possible to book an unavailable doctor