FirstBlood-#109 — An new user account can bypass security and view all appointment data
This issue was discovered on FirstBlood v1
On 2021-05-10, xnl-h4ck3r Level 4 reported:
**NOTE: THIS WAS INCORPORATED INTO REPORT #106 BECAUSE I WANTED TO MAKE A BETTER INITIAL REPORT :)
An authoriation vulnerability exists that allows a new user to access pateinet appointment PII data. When logged in as a new account, the user cannot look at a pateients appointment on
/drpanel/index.php, and is given the message "You are not authorised to view this. Consult your medical administrator.". A user can bypass this security and call endpoint
/drpanel/drapi/query.phpdirectly and access the data. An IDOR exists on the parameter
aptidof this endpoint.
Steps to Reproduce
- Log in as a new user, and observe the message below:
- To bypass this security, send a GET request to
/drpanel/drapi/query.phpwith the cookies of the logged in user, and query parameter of
- Observe the response with data of a patients appointment:
NOTE: An IDOR exists that means the appt value is 5691???? where
????is enumerated by adding 137 to the previous value each time.
Authorisation controls can be bypassed allowed new users access to patient appointment PII data
FirstBlood ID: 11
Vulnerability Type: Application/Business Logic
Administrator endpoints can be accessed by non privileged doctor accounts which reveals sensitive patient information.