FirstBlood-#380 — Easily guessed invited code on doctor register
This issue was discovered on FirstBlood v2.0.0 (issues patched)
On 2021-10-25, neolex Level 2 reported:
It is possible to register a doctor because the invite code is easily guessable. The current invite code is
Step to reproduce
- Open https://166c17900f08-neolex.a.firstbloodhackers.com/register.php
- Choose your username and use the invite code
- You will have your Doctor account created !
You should make an invite code not easily guessable
Attackers can register as a doctor
FirstBlood ID: 24
Vulnerability Type: Auth issues
The old invite code was deleted but when testing FirstBlood v2 the developers accidentally left the test code working.