CVE-2022-36202

Doctor's Appointment System 1.0 is vulnerable to incorrect access control in the file edoc/patient/settings.php. The lack of authorization allows an attacker to manipulate the id parameter, leading to unauthorized access to other patients' data.

The organization is at risk of unauthorized access to sensitive patient data, which may result in leakage of medical information and violation of data protection regulations.

Immediately implement authorization mechanisms in settings.php to verify user permissions before processing the id parameter. It is also recommended to update the system to the latest version.