Easily guessed invited code on doctor register

FirstBlood-#380 — Easily guessed invited code on doctor register
This issue was discovered on FirstBlood v2

This report has been reviewed and accepted as a valid vulnerability on FirstBlood!

On 2021-10-25, neolex Level 2 reported:


Description
It is possible to register a doctor because the invite code is easily guessable.
The current invite code is test
Step to reproduce

Open https://166c17900f08-neolex.a.firstbloodhackers.com/register.php
Choose your username and use the invite code test
You will have your Doctor account created !


Fix
You should make an invite code not easily guessable
Impact
Attackers can register as a doctor

This report has been publicly disclosed for everyone to view

P3 Medium

Endpoint: /register.php

Parameter: inviteCode

Payload: test

FirstBlood ID: 24
Vulnerability Type: Auth issues

The old invite code was deleted but when testing FirstBlood v2 the developers accidentally left the test code working.

BugBountyHunter

Description

Step to reproduce

Fix

Impact