FirstBlood-#136 — Leaked invite ID allows anyone to register for an account.
This report has been reviewed and accepted as a valid vulnerability on FirstBlood!
On 2021-05-10, 0xblackbird reported:
Hi Zseano! I found out that anyone can register for an account because of a leaked invite code. This invite code was posted on a comment on Reddit.
A simple Google search reveals a comment on Reddit.
The one that posted this asked for assistance and (accidently) posted the invite code with it.
Now we can use this invite code on any other account. Correct me if I'm wrong but I think this itself is a business logic error.
Steps to reproduce
- Copy the password and visit
/login.php or click on Continue to login.
- Now enter your username and paste the password and click on Secure Login.
- We successfully created and logged into the account :D!
We were able to create multiple accounts using one leaked invitation code. Normally, even if the code is leaked, it should check for which username it is generated. And because of this missing check, no validation is done and this works for any account we want to generate.
Have a nice day!
This report has been publicly disclosed for everyone to view
FirstBlood ID: 15
Vulnerability Type: Auth issues
A doctors invite code is leaked on the internet which if used grants anyone access to the doctor portal. The invite code should expire after use.
Respect Earnt: 2000000
is an experimental cryptocurrency based on the Ethereum blockchain with the mission to show respect to those who deserve it. We are testing it out on our FirstBlood hackevent.