FirstBlood-#148 — New Doctors can use the api to get patients data
This issue was discovered on FirstBlood v1
On 2021-05-10, 0xSaltyHash Level 2 reported:
When you register a new doctor account and log in you get a message saying that new doctors can't access patient information.
But I can interact with the drapi endpoints without problems, if I know the appointment id I can query the api and get the patient info and the api request is shown in the page html.
But to be able to exploit this to the full extent you need to know the aptid somehow (you can bruteforce it).
also we can search for patients using the search api on this endpoint
Steps to reproduce:
- Go to /register and enter your username and invitecode.
- After that log in using the credential generated.
- Go to
FirstBlood ID: 11
Vulnerability Type: Application/Business Logic
Administrator endpoints can be accessed by non privileged doctor accounts which reveals sensitive patient information.