Administrator access via attacker-controlled adminmail session value

Authorization bypass in Online Clinic Management System allows remote attackers to reach the administrator appointment view through adminappview.php. The page starts a session and treats the attacker-controlled adminmail value as an administrator identity without verifying an authenticated administrator session. Network access to the PHP page is sufficient, and successful exploitation exposes the administrator-only appointment view.