FirstBlood-#1548Anyone can edit ambulances
This issue was discovered on FirstBlood v3



On 2022-12-11, pichik Level 4 reported:

Hi,

DESCRIPTION

After creating custom wordlist I found another hidden endpoint /api/manageambulances.php.
This endpoint allows anyone to edit ambulances.
As POST gives us Unauthorised!, we can just use PUT request, which works fine.
By working step by step on this request, response will reveal to us everything what we need - that we need to send json and all params requried.

Here is simple request:

PUT /api/manageambulances.php HTTP/1.1
Host: 63c0f77f87b7-pichik.a.firstbloodhackers.com
Content-Length: 101

{
"driver":"No driver for you",
"number":"1337",
"ambId":"1e69d88d-08f9-4429-890c-bd11d4bd3e09"
}

POC SCREEN:

IMPACT:

Attacker can create chaos, or chain it with another bugs to attack users.

REMEDIATION:

Be more careful with managing/removing public endpoints, as they still be fuzzed accessed if no server side prevention is added.
This endpoint should be made just internal only.

P2 High

Endpoint: /api/manageambulances.php

Parameter: Method

Payload: PUT


FirstBlood ID: 73
Vulnerability Type: Stored XSS

The endpoint /api/manageambulances.php will respond to an unauthenticated PUT request which allows an attacker to modify the information