FirstBlood-#148New Doctors can use the api to get patients data



On 2021-05-10, 0xn00b reported:

Summary:

When you register a new doctor account and log in you get a message saying that new doctors can't access patient information.

But I can interact with the drapi endpoints without problems, if I know the appointment id I can query the api and get the patient info and the api request is shown in the page html.

But to be able to exploit this to the full extent you need to know the aptid somehow (you can bruteforce it).

also we can search for patients using the search api on this endpoint /drpanel/drapi/qp.php?name=s

Steps to reproduce:

  1. Go to /register and enter your username and invitecode.

  1. After that log in using the credential generated.
  2. Go to /drpanel/drapi/qp.php?name=s

P1 CRITICAL

Endpoint: /drpanel/drapi/qp.php

Parameter: name=

Payload: GET /drpanel/drapi/qp.php?name=s


FirstBlood ID: 11
Vulnerability Type: Application/Business Logic

Administrator endpoints can be accessed by non privileged doctor accounts which reveals sensitive patient information.


Respect Earnt: 1500000
RESPECT ($RSP) is an experimental cryptocurrency based on the Ethereum blockchain with the mission to show respect to those who deserve it. We are testing it out on our FirstBlood hackevent.