FirstBlood-#151Event attendees leaked



On 2021-05-10, 0xn00b reported:

Summary:

Event attendees are leaked by injecting custom header found on sitesettings.php when querying the /attendees/event.php?q=560720

Steps to reproduce:

  1. Go to /hackerback.html.
  2. In the page source there is a JS script calling /attendees/event.php?q=560720
  3. Try accessing this endpoint and you will get a blank page.
  4. Go to /drpanel/drapi/sitesettings.php.

  1. There is a custom header that is mentioned in that file x-site-req: permitted.
  2. try accessing /drpanel/drapi/sitesettings.php this time intercept the request in burp.
  3. Add the custom header and forward the request.

  1. Profit!.

EDIT: I revisited the Bug again and I was able to access PII by querying the old_eventID.

P1 CRITICAL

Endpoint: /attendees/event.php?q=

Parameter: Header

Payload: x-site-req: permitted


FirstBlood ID: 13
Vulnerability Type: Info leak

/attendees/event can be seen on the HackerBack.html page but has a blank response. Upon further inspection and from making use of the web app, you will notice you can add certain headers in order to interact with this endpoint. An old event ID leaks PII information about attendees.


Respect Earnt: 1500000
RESPECT ($RSP) is an experimental cryptocurrency based on the Ethereum blockchain with the mission to show respect to those who deserve it. We are testing it out on our FirstBlood hackevent.