Description

Hi,
I found that appointment ID, which is used by administrator in /drpanel/drapi/query.php?aptid=56910219 to show appointment info,
can be used in editing of appointments by the users.
As this number is not that big and 5691 is not changing, it can be easily used to IDOR.

Steps to reproduce:

1. Create your appointment here: http://firstbloodhackers.com/book-appointment.html
2. Save your ID and visit your appointment here:http://firstbloodhackers.com/yourappointments.php
3. Start burpsuite interception. Click Modify appointment
4. Remove your id and enumerate through all ID 5691****
5. Every appointment registered will be changed

It also says that For safeguarding reasons you are only able to modify certain information about your appointment., but email can be changed anyway, by adding parameter to the post request.

Impact

Impact may be critical as an attacker act as users that appointment belongs to, so he can ask for changing appointment date, etc.. with Extra comments
He can also change email of appointments and can get more detailed info about appointments, or even the results of appointment