FirstBlood-#118 — Info leak for events and attendees including PII data
This issue was discovered on FirstBlood v1
On 2021-05-10, xnl-h4ck3r Level 4 reported:
Getting started
Learn about vulnerability types 
Getting started in bug bounties 
Test your knowledge
Free Web Application Challenges
Guides for your hunts 
ZSeano's Methodology
Effective Note Taking for bug bounties
Useful Resources 
Disclosed HackerOne Reports 
Our community
Endorsed Members
Hackevents 
Member Articles
Summary
There is an info leak vulnerability on /attendees/event.php where any user can view event data including PII of attendees.
Steps to Reproduce
- Make the following GET request:
GET /attendees/event.php?q=560700`
X-SITE-REQ: permitted
- Send as shown below and observe the persponal data
Impact
Any user has access to view event information including the following PII about each attendee:
Name, Email, Phone number and Last 4 digits of Credit Card
P1 CRITICAL
Endpoint: /attendees/event.php
Parameter: q
Payload: q=560700
FirstBlood ID: 13
Vulnerability Type: Information leak/disclosure
/attendees/event can be seen on the HackerBack.html page but has a blank response. Upon further inspection and from making use of the web app, you will notice you can add certain headers in order to interact with this endpoint. An old event ID leaks PII information about attendees.