FirstBlood-#1548Anyone can edit ambulances
This issue was discovered on FirstBlood v3

On 2022-12-11, pichik Level 4 reported:



After creating custom wordlist I found another hidden endpoint /api/manageambulances.php.
This endpoint allows anyone to edit ambulances.
As POST gives us Unauthorised!, we can just use PUT request, which works fine.
By working step by step on this request, response will reveal to us everything what we need - that we need to send json and all params requried.

Here is simple request:

PUT /api/manageambulances.php HTTP/1.1
Content-Length: 101

"driver":"No driver for you",



Attacker can create chaos, or chain it with another bugs to attack users.


Be more careful with managing/removing public endpoints, as they still be fuzzed accessed if no server side prevention is added.
This endpoint should be made just internal only.

P2 High

Endpoint: /api/manageambulances.php

Parameter: Method

Payload: PUT

FirstBlood ID: 73
Vulnerability Type: Stored XSS

The endpoint /api/manageambulances.php will respond to an unauthenticated PUT request which allows an attacker to modify the information