FirstBlood-#328 — Valid doctor credentials could be obtained without an invitation code
      
                  This issue was discovered on FirstBlood v2
         
 On 2021-10-25, panya  Level 7        
 reported:
 Level 7        
 reported:
        Steps to reproduce:
- Visit doctor registration page.
- Fill the form with adminas username andtestas the invite code.
- Press on "Secure Register" button.
Actual result:
Registration will be successful. The message with valid creds will be shown:
Success! Your account has been created with the following credentials:
Username: admin
Password: PyI0OYm016
Please save this in a secure place.
Expected result:
The testing creds (test as the invite code) should not be working on production.
The form should properly validate the filled invite code.
Impact:
An attacker could get credentials to login as a doctor.
        
            P3 Medium
Endpoint: /register.php        
                        
Parameter: inviteCode
Payload: test
FirstBlood ID: 24      
      Vulnerability Type: Auth issues
The old invite code was deleted but when testing FirstBlood v2 the developers accidentally left the test code working.