FirstBlood-#166 — PII Creditcard information leaking via Event
This report has been reviewed and accepted as a valid vulnerability on FirstBlood!
On 2021-05-11, mava reported:
I found a vulnerability which leaks PII.
An attacker can craft a request which reveals a lot of PII data, including "last_4_cc" creditcard information.
- Visit /drpanel/drapi/sitesettings.php you will see some information like:
- This leaks the headers
- Add these to the
/attendees/event.php?q=560720 endpoint to see some PII:
- From this information we can get the "old_eventID", if we fetch the same endpoint with this ID we get:
- This reveals who is attending the event and also show their creditcard information "last_4_cc".
Unauthenticated access to a lot of PII including Email, Creditcard Information, Phone number.
This could be used to impersonate a victim in e.g. a Sim-Swapping Social Engineering attack like it was done on Twitter last year.
Implement better authentication for the
/attendees/event.php endpoint and disable the
/drpanel/drapi/sitesettings.php Endpoint completly.
This report has been publicly disclosed for everyone to view
FirstBlood ID: 13
Vulnerability Type: Info leak
/attendees/event can be seen on the HackerBack.html page but has a blank response. Upon further inspection and from making use of the web app, you will notice you can add certain headers in order to interact with this endpoint. An old event ID leaks PII information about attendees.
Respect Earnt: 1500000
is an experimental cryptocurrency based on the Ethereum blockchain with the mission to show respect to those who deserve it. We are testing it out on our FirstBlood hackevent.