FirstBlood-#16 — Editing other users appointments with IDOR
This issue was discovered on FirstBlood v1
On 2021-05-09, pichik reported:
I found that appointment ID, which is used by administrator in
/drpanel/drapi/query.php?aptid=56910219 to show appointment info,
can be used in editing of appointments by the users.
As this number is not that big and 5691 is not changing, it can be easily used to IDOR.
Steps to reproduce:
- Create your appointment here:
- Save your ID and visit your appointment here:
- Start burpsuite interception. Click Modify appointment
- Remove your
id and enumerate through all ID 5691****
- Every appointment registered will be changed
It also says that
For safeguarding reasons you are only able to modify certain information about your appointment., but
email can be changed anyway, by adding parameter to the post request.
Impact may be critical as an attacker act as users that appointment belongs to, so he can ask for changing appointment date, etc.. with
He can also change email of appointments and can get more detailed info about appointments, or even the results of appointment
FirstBlood ID: 6
Vulnerability Type: Insecure direct object reference
The endpoint MA.php (to modify an appointment) will allow for integer values to be used when modifying appointments. A bad cause of security through obscurity was attempted.