FirstBlood-#14 — The patient email can be changed even though the application UI mentioned that this is not allowed.
This report has been reviewed and accepted as a valid vulnerability on FirstBlood!
On 2021-05-09, bobbylin reported:
I managed to change the patient email in the appointment even though this is not allowed by the application.
First, we test all the parameters that is not allowed to be changed.
The patient email appears to be changeable by the patient.
The impact is that if the appointment id is stolen by an attacker, he can change the email to his own email and hijack the correspondence with the hospital.
This report has been publicly disclosed for everyone to view
FirstBlood ID: 7
Vulnerability Type: Application/Business Logic
The endpoint MA.php (to modify an appointment) only allows for certain values to be modified, however due to some application logic error, if the user has tried to signup as a doctor and has the cookie "doctorAuthed" set, then it allows them to modify the email address for any appointment.
Creator & Administrator
Respect Earnt: 1000000
is an experimental cryptocurrency based on the Ethereum blockchain with the mission to show respect to those who deserve it. We are testing it out on our FirstBlood hackevent.