Summary:

Hi

I found out that the /api/ambulances.php discloses UUIDs + private data of all appointments made (where ambulance was set to 1 during booking). This should not be possible for unprivileged users.

Possible cause:

The developers may have added the all keyword for debugging purposes but forgot about it somehow.

Impact:

I was able to reveal the all the private appointment's data + UUID (this allows me to modify them for example). This shouldn't be possible.

Steps to reproduce:

1) After visiting /api/ambulances.php?select=all for example, we can find the full location in the response

Mitigation

I recommend removing all keyword from this endpoint for unprivileged users.

Have a nice day!

Kind regards,

0xblackbird