FirstBlood-#142 — IDOR on newly registered doctor
This report has been reviewed and accepted as a valid vulnerability on FirstBlood!
On 2021-05-10, codersanjay reported:
A newly registered doctor cannot see the patients info in general,
but with aptid known or randomly guessing, he can still get the patients info by just sending a GET request to
This report has been publicly disclosed for everyone to view
FirstBlood ID: 11
Vulnerability Type: Application/Business Logic
Administrator endpoints can be accessed by non privileged doctor accounts which reveals sensitive patient information.
Respect Earnt: 1500000
is an experimental cryptocurrency based on the Ethereum blockchain with the mission to show respect to those who deserve it. We are testing it out on our FirstBlood hackevent.