A non admin doctor can still view patient information using the api

**You are viewing our old website - new website soon...!**

We are getting close to releasing BugBountyHunter v2 which will introduce a brand new website, including member platforms, new features, challenges, guides, videos, and the long awaited zseano methodology v2. Right now, all of the content on this website is considered out-dated, however our members section continues to operate for members.

Stay tuned for updates coming soon!

FirstBlood-#279 — A non admin doctor can still view patient information using the api
This issue was discovered on FirstBlood v1

This report has been reviewed and accepted as a valid vulnerability on FirstBlood!

On 2021-05-15, twsec Level 2 reported:


        after logging in as non admin doctor we notice that we are not allowed to view patient information.

but using the api **/drapi/query.php?aptid=<idnumber> he can access that info

This report has been publicly disclosed for everyone to view

P2 High

Endpoint: /drapi/query.php?aptid=

Parameter: drapi

Payload: enter the patient information

FirstBlood ID: 11
Vulnerability Type: Application/Business Logic

Administrator endpoints can be accessed by non privileged doctor accounts which reveals sensitive patient information.