FirstBlood-#136Leaked invite ID allows anyone to register for an account.
This issue was discovered on FirstBlood v1

On 2021-05-10, 0xblackbird Level 5 reported:

Hi Zseano! I found out that anyone can register for an account because of a leaked invite code. This invite code was posted on a comment on Reddit.


A simple Google search reveals a comment on Reddit.

The one that posted this asked for assistance and (accidently) posted the invite code with it.

Now we can use this invite code on any other account. Correct me if I'm wrong but I think this itself is a business logic error.

Invite Code


Steps to reproduce

  • Visit /register.php

  • Next, choose a username and paste in the invite code we found on Reddit and click on Secure Register.

  • Copy the password and visit /login.php or click on Continue to login.

  • Now enter your username and paste the password and click on Secure Login.

  • We successfully created and logged into the account :D!


We were able to create multiple accounts using one leaked invitation code. Normally, even if the code is leaked, it should check for which username it is generated. And because of this missing check, no validation is done and this works for any account we want to generate.

Have a nice day!

Kind regards, 0xblackbird

P2 High

Endpoint: /register.php

Parameter: inviteCode

Payload: F16CA47250E445888824A9E63AE445CE

FirstBlood ID: 15
Vulnerability Type: Auth issues

A doctors invite code is leaked on the internet which if used grants anyone access to the doctor portal. The invite code should expire after use.