BugBountyHunter

Hi there

I found it is possible for a unauthenticated user to edit a doctors profile via a api call to /api/managedoctors.php

To reproduce :

1. Visit firstbloodhackers.com/api/managedoctors.php and intercept the request
2. Change the request to a PUT request
3. Add the following JSON to the data and forward the request

   {"name": "Edited",
   "bio":"More editing here",
   "tagline":"Even more editing here",
   "drId":"1"
   }

Image before editing

As you can see the doctors information has been changed

Image after editing