FirstBlood-#16Editing other users appointments with IDOR
This issue was discovered on FirstBlood v1

On 2021-05-09, pichik Level 4 reported:


I found that appointment ID, which is used by administrator in /drpanel/drapi/query.php?aptid=56910219 to show appointment info,
can be used in editing of appointments by the users.
As this number is not that big and 5691 is not changing, it can be easily used to IDOR.

Steps to reproduce:

  1. Create your appointment here:
  2. Save your ID and visit your appointment here:
  3. Start burpsuite interception. Click Modify appointment
  4. Remove your id and enumerate through all ID 5691****
  5. Every appointment registered will be changed

It also says that For safeguarding reasons you are only able to modify certain information about your appointment., but email can be changed anyway, by adding parameter to the post request.


Impact may be critical as an attacker act as users that appointment belongs to, so he can ask for changing appointment date, etc.. with Extra comments
He can also change email of appointments and can get more detailed info about appointments, or even the results of appointment

P2 High

Endpoint: /api/ma.php

Parameter: id

Payload: 569*****

FirstBlood ID: 6
Vulnerability Type: Insecure direct object reference

The endpoint MA.php (to modify an appointment) will allow for integer values to be used when modifying appointments. A bad cause of security through obscurity was attempted.

Report Feedback


Creator & Administrator

Nice find pichik!