FirstBlood-#1142 — CSRF leading to Modify the doctors data
This issue was discovered on FirstBlood v3

On 2022-12-08, mr_xhunt Level 8 reported:

Summary

I was able to login using default credentials: admin:admin, I found while modifying the data of the doctors there is a anti-csrf token csrf but it is useless as it is not being verified, thus we can create a CSRF Poc and exploit

Steps to Reproduce:

  1. Login to the doctor panel
  2. Now Modify any doctor data and Intercept it using burp
  3. Now Remove the Csrf token or even Can be left as it is not being verified
  4. Create CSRF POCand Host it on your server

  1. Send the link of your page to victim (note: victim must be logged in as admin)
  2. When the Victim visits the link, the script will automatically Modify the Doctors data

Remeditation:

The Anti-CSRF token must be verified before modifying the data

P4 Low

Endpoint: /drpanel/drapi/edit-dr.php

Parameter: csrf

Payload: *

FirstBlood ID: 58
Vulnerability Type: Cross Site Request Forgery

There is a CSRF vulnerability on /drpanel/edit-dr.php via a GET request and lack of token validation. It was intended that a POST request does not work due to no cookies sent on the request (because of SameSite), but to an over sight this cookie was overwritten rendering it useless.