FirstBlood-#215 — Account Creation with same Username overrides the one made before.
This issue was discovered on FirstBlood v1

On 2021-05-12, smhtahsin33 Level 3 reported:

Hi, I Found a Leaked Invite Code on Reddit while doing OSINT via https://www.reddit.com/r/BugBountyHunter/comments/n4xzw1/firstbloodhackerscom_doctor_registration/ Using this we can create account on firstbloodhackers.com. I observed that creating multiple accounts with same username is possible which overrides the password of the one created before.

Steps To Reproduce:

  1. Visit /register.php
  2. Create an account name "admin" once and provide F16CA47250E445888824A9E63AE445CE in the token field.
  3. Then Login
  4. Again create account with the same username on another browser and then refresh the logged in page. You will see you got logged out and you cannot use the password retrieved before.
  5. Now use the password generated newly and you can easily log into.

Impact: Account Takeover

P2 High

Endpoint: /register.php

This report contains multiple vulnerabilities:

  • Authorisation Issue
  • Auth issues

FirstBlood ID: 17
Vulnerability Type: Auth issues

Unintended: An account with the same username can be created which leads to the original account being deleted and replaced with the attackers

FirstBlood ID: 15
Vulnerability Type: Auth issues

A doctors invite code is leaked on the internet which if used grants anyone access to the doctor portal. The invite code should expire after use.