FirstBlood-#234 — Event is leaking attendees Personal information.
This report has been reviewed and accepted as a valid vulnerability on FirstBlood!
On 2021-05-14, th4nu0x0 reported:
On /hackerback.html there's a endpoint mentioned on the page source
/attendees/event.php?q=560720 which seems to do nothing when we just visit the endpoint normally but by adding the header
x-site-req: permitted the endpoint reveals the PII of the attendees like email, name, contact number and last 4 digit of CC.
Steps To Reproduce:
- Visit http://firstbloodhackers.com/attendees/event.php?q=560700 you'll just encounter 200 OK with nothing in response.
- Now visit the same URL and intercept the request and add this header to the request
Disclosure of PII of Event attendees.
This report has been publicly disclosed for everyone to view
FirstBlood ID: 13
Vulnerability Type: Info leak
/attendees/event can be seen on the HackerBack.html page but has a blank response. Upon further inspection and from making use of the web app, you will notice you can add certain headers in order to interact with this endpoint. An old event ID leaks PII information about attendees.
Respect Earnt: 1500000
is an experimental cryptocurrency based on the Ethereum blockchain with the mission to show respect to those who deserve it. We are testing it out on our FirstBlood hackevent.