BugBountyHunter

Hi Zseano! I found out that anyone can register for an account because of a leaked invite code. This invite code was posted on a comment on Reddit.

Approach

A simple Google search reveals a comment on Reddit.

The one that posted this asked for assistance and (accidently) posted the invite code with it.

Now we can use this invite code on any other account. Correct me if I'm wrong but I think this itself is a business logic error.

Invite Code

F16CA47250E445888824A9E63AE445CE https://www.reddit.com/r/BugBountyHunter/comments/n4xzw1/firstbloodhackerscom_doctor_registration/

Steps to reproduce

• Visit /register.php

• Next, choose a username and paste in the invite code we found on Reddit and click on Secure Register.

• Copy the password and visit /login.php or click on Continue to login.

• Now enter your username and paste the password and click on Secure Login.

• We successfully created and logged into the account :D!

Impact

We were able to create multiple accounts using one leaked invitation code. Normally, even if the code is leaked, it should check for which username it is generated. And because of this missing check, no validation is done and this works for any account we want to generate.

Have a nice day!

Kind regards, 0xblackbird