FirstBlood-#215Account Creation with same Username overrides the one made before.



On 2021-05-12, smhtahsin33 reported:

Hi, I Found a Leaked Invite Code on Reddit while doing OSINT via https://www.reddit.com/r/BugBountyHunter/comments/n4xzw1/firstbloodhackerscom_doctor_registration/ Using this we can create account on firstbloodhackers.com. I observed that creating multiple accounts with same username is possible which overrides the password of the one created before.

Steps To Reproduce:

  1. Visit /register.php
  2. Create an account name "admin" once and provide F16CA47250E445888824A9E63AE445CE in the token field.
  3. Then Login
  4. Again create account with the same username on another browser and then refresh the logged in page. You will see you got logged out and you cannot use the password retrieved before.
  5. Now use the password generated newly and you can easily log into.

Impact: Account Takeover

P2 High

Endpoint: /register.php This bug makes use of the following vulnerabilities in a chain:

  • Auth issues
  • Auth issues


FirstBlood ID: 17
Vulnerability Type: Auth issues

Unintended: An account with the same username can be created which leads to the original account being deleted and replaced with the attackers

FirstBlood ID: 15
Vulnerability Type: Auth issues

A doctors invite code is leaked on the internet which if used grants anyone access to the doctor portal. The invite code should expire after use.


Respect Earnt: 2000000
RESPECT ($RSP) is an experimental cryptocurrency based on the Ethereum blockchain with the mission to show respect to those who deserve it. We are testing it out on our FirstBlood hackevent.