FirstBlood-#143 — IDOR on /drpanel/drapi/qp.php endpoint
This issue was discovered on FirstBlood v1
On 2021-05-10, codersanjay Level 3 reported:
Getting started
Learn about vulnerability types 
Getting started in bug bounties 
Test your knowledge
Free Web Application Challenges
Guides for your hunts 
ZSeano's Methodology
Effective Note Taking for bug bounties
Useful Resources 
Disclosed HackerOne Reports 
Our community
Endorsed Members
Hackevents 
Member Articles
When a new doctor registers , he cannot search for patient details.
But by sending a POST request to the following end point from the newly created doc account, Full PII disclosure of all patients is possible.
Impact
Full PII disclosure.
P1 CRITICAL
Endpoint: /drpanel/drapi/qp.php
Parameter: name
Payload: ""
FirstBlood ID: 11
Vulnerability Type: Application/Business Logic
Administrator endpoints can be accessed by non privileged doctor accounts which reveals sensitive patient information.