FirstBlood-#118Info leak for events and attendees including PII data



On 2021-05-10, xnl-h4ck3r Level 4 reported:

Summary

There is an info leak vulnerability on /attendees/event.php where any user can view event data including PII of attendees.

Steps to Reproduce

  1. Make the following GET request:
    GET /attendees/event.php?q=560700`
    X-SITE-REQ: permitted
  2. Send as shown below and observe the persponal data

Impact

Any user has access to view event information including the following PII about each attendee: Name, Email, Phone number and Last 4 digits of Credit Card

P1 CRITICAL

Endpoint: /attendees/event.php

Parameter: q

Payload: q=560700


FirstBlood ID: 13
Vulnerability Type: Information leak/disclosure

/attendees/event can be seen on the HackerBack.html page but has a blank response. Upon further inspection and from making use of the web app, you will notice you can add certain headers in order to interact with this endpoint. An old event ID leaks PII information about attendees.


Respect Earnt: 1.5M
RESPECT ($RSP) is an experimental cryptocurrency based on the Ethereum blockchain with the mission to show respect to those who deserve it. We are testing it out on our FirstBlood hackevent.