BugBountyHunter

Hello Team,

Summary:

On doctors.php endpoint, we can see that we can only book some doctors(who are bookable) but after reading the source code, I found this piece of code:

       if (window.location.hash) {

        var urlParams = new URLSearchParams(window.location.hash.replace("#","?"));
        var drHash = urlParams.get('doctor');
            document.getElementById("drId").value = drHash;
           // history.pushState('', '', '/book-appointment.html')
            history.pushState('', '', '/book-appointment.php')
        }

So instead of relying on UI, I visited the https://1e2176df1447-ayush1098.a.firstbloodhackers.com/book-appointment.php#doctor=1

Note: The doctor with id=1 is not bookable

And to be surprised, I was able to book appointments with this doctor.

Steps To Reproduce:

1. Visit the https://1e2176df1447-ayush1098.a.firstbloodhackers.com/book-appointment.php#doctor=1.

2. Book the appointment.

view your appointment and the Julie is booked as a doctor.

Thanks & Regards

Ayush Singh