FirstBlood-#166PII Creditcard information leaking via Event



On 2021-05-11, mava reported:

Hi Sean, I found a vulnerability which leaks PII.

Summary

An attacker can craft a request which reveals a lot of PII data, including "last_4_cc" creditcard information.

PoC

  1. Visit /drpanel/drapi/sitesettings.php you will see some information like:
  2. This leaks the headers x-required: permittedand x-site-req: permitted.
  3. Add these to the /attendees/event.php?q=560720 endpoint to see some PII:
  4. From this information we can get the "old_eventID", if we fetch the same endpoint with this ID we get:
  5. This reveals who is attending the event and also show their creditcard information "last_4_cc".

Impact

Unauthenticated access to a lot of PII including Email, Creditcard Information, Phone number.
This could be used to impersonate a victim in e.g. a Sim-Swapping Social Engineering attack like it was done on Twitter last year.

Potential Fix

Implement better authentication for the /attendees/event.php endpoint and disable the /drpanel/drapi/sitesettings.php Endpoint completly.

Best regards,
Max

P1 CRITICAL

Endpoint: /attendees/event.php

Parameter: q=

Payload: 560700


FirstBlood ID: 13
Vulnerability Type: Info leak

/attendees/event can be seen on the HackerBack.html page but has a blank response. Upon further inspection and from making use of the web app, you will notice you can add certain headers in order to interact with this endpoint. An old event ID leaks PII information about attendees.


Respect Earnt: 1500000
RESPECT ($RSP) is an experimental cryptocurrency based on the Ethereum blockchain with the mission to show respect to those who deserve it. We are testing it out on our FirstBlood hackevent.