$ Authentication-Bypass

Doctor Appointment 1

SQLi auth-bypass in a healthcare login. Send the injection to the API and read the full JSON response - it leaks the username, password and flag.