Account takeover via unchecked patient identifier

Authorization bypass in Hospital Management System 1.0 allows remote authenticated users to modify other patients' accounts. The /patient/edit-user.php handler inserts the POST id00 value into the patient update query without checking that the record belongs to the session account. A valid patient session is required; changing a victim's email or password enables unauthorized data modification and account takeover.