Delete Ambulance Provided to any Appointment

**You are viewing our old website - new website soon...!**

We are getting close to releasing BugBountyHunter v2 which will introduce a brand new website, including member platforms, new features, challenges, guides, videos, and the long awaited zseano methodology v2. Right now, all of the content on this website is considered out-dated, however our members section continues to operate for members.

Stay tuned for updates coming soon!

FirstBlood-#1683 — Delete Ambulance Provided to any Appointment
This issue was discovered on FirstBlood v3

This report has been reviewed and accepted as a valid vulnerability on FirstBlood!

On 2022-12-13, mr_xhunt Level 8 reported:


        Summary:
Sending DELETE method on endpoint /api/manageambulances.php with ambulance Id will Delete the ambulance provided to any Appointment.
Steps To Reproduce:

Create an Appointment with ambulance:



Now Get the abmulance_id assigned to you via following request:



Send DELETE method request to /api/manageambulances.php with ambId parameter and Paste the value got from step 2

This report has been publicly disclosed for everyone to view

P2 High

Endpoint: /api/manageambulances.php

Parameter: ambId

Payload: d9010b9b-8c1e-427c-979a-8b41fce1fb37

FirstBlood ID: 77
Vulnerability Type: Access_control

Sending an unauthenticated DELETE request to /api/manageambulances.php will cause that ambulance to be deleted