drchrono: CSRF Add Album On onpatient.com

Hi I'm Found Bug CSRF It is Possible To Add Album By Attacker on onpatient.com Steps to verify ---- . Login as attacker . Go to photos and click add album . rename album for example :- hacking . . intercept this request add using burp proxy or any other tool you can see X-CSRFToken and sessionid...