FirstBlood-#148 — New Doctors can use the api to get patients data
This report has been reviewed and accepted as a valid vulnerability on FirstBlood!
On 2021-05-10, 0xn00b reported:
When you register a new doctor account and log in you get a message saying that new doctors can't access patient information.
But I can interact with the drapi endpoints without problems, if I know the appointment id I can query the api and get the patient info and the api request is shown in the page html.
But to be able to exploit this to the full extent you need to know the aptid somehow (you can bruteforce it).
also we can search for patients using the search api on this endpoint
Steps to reproduce:
- Go to /register and enter your username and invitecode.
- After that log in using the credential generated.
- Go to
This report has been publicly disclosed for everyone to view
FirstBlood ID: 11
Vulnerability Type: Application/Business Logic
Administrator endpoints can be accessed by non privileged doctor accounts which reveals sensitive patient information.
Respect Earnt: 1500000
is an experimental cryptocurrency based on the Ethereum blockchain with the mission to show respect to those who deserve it. We are testing it out on our FirstBlood hackevent.