FirstBlood-#166PII Creditcard information leaking via Event

On 2021-05-11, mava reported:

Hi Sean, I found a vulnerability which leaks PII.


An attacker can craft a request which reveals a lot of PII data, including "last_4_cc" creditcard information.


  1. Visit /drpanel/drapi/sitesettings.php you will see some information like:
  2. This leaks the headers x-required: permittedand x-site-req: permitted.
  3. Add these to the /attendees/event.php?q=560720 endpoint to see some PII:
  4. From this information we can get the "old_eventID", if we fetch the same endpoint with this ID we get:
  5. This reveals who is attending the event and also show their creditcard information "last_4_cc".


Unauthenticated access to a lot of PII including Email, Creditcard Information, Phone number.
This could be used to impersonate a victim in e.g. a Sim-Swapping Social Engineering attack like it was done on Twitter last year.

Potential Fix

Implement better authentication for the /attendees/event.php endpoint and disable the /drpanel/drapi/sitesettings.php Endpoint completly.

Best regards,


Endpoint: /attendees/event.php

Parameter: q=

Payload: 560700

FirstBlood ID: 13
Vulnerability Type: Info leak

/attendees/event can be seen on the HackerBack.html page but has a blank response. Upon further inspection and from making use of the web app, you will notice you can add certain headers in order to interact with this endpoint. An old event ID leaks PII information about attendees.

Respect Earnt: 1500000
RESPECT ($RSP) is an experimental cryptocurrency based on the Ethereum blockchain with the mission to show respect to those who deserve it. We are testing it out on our FirstBlood hackevent.