FirstBlood-#109An new user account can bypass security and view all appointment data



On 2021-05-10, xnl-h4ck3r reported:

**NOTE: THIS WAS INCORPORATED INTO REPORT #106 BECAUSE I WANTED TO MAKE A BETTER INITIAL REPORT :)

Summary

An authoriation vulnerability exists that allows a new user to access pateinet appointment PII data. When logged in as a new account, the user cannot look at a pateients appointment on /drpanel/index.php, and is given the message "You are not authorised to view this. Consult your medical administrator.". A user can bypass this security and call endpoint /drpanel/drapi/query.php directly and access the data. An IDOR exists on the parameter aptid of this endpoint.

Steps to Reproduce

  1. Log in as a new user, and observe the message below:

  1. To bypass this security, send a GET request to /drpanel/drapi/query.php with the cookies of the logged in user, and query parameter of aptid=56910619 for example.
  2. Observe the response with data of a patients appointment:

NOTE: An IDOR exists that means the appt value is 5691???? where ???? is enumerated by adding 137 to the previous value each time.

Impact

Authorisation controls can be bypassed allowed new users access to patient appointment PII data

P1 CRITICAL

Endpoint: /drpanel/drapi/query.php

Parameter: appt

Payload: aptid=56910619


FirstBlood ID: 11
Vulnerability Type: Application/Business Logic

Administrator endpoints can be accessed by non privileged doctor accounts which reveals sensitive patient information.


Respect Earnt: 1500000
RESPECT ($RSP) is an experimental cryptocurrency based on the Ethereum blockchain with the mission to show respect to those who deserve it. We are testing it out on our FirstBlood hackevent.