We are getting close to releasing BugBountyHunter v2 which will introduce a brand new website, including member platforms, new features, challenges, guides, videos, and the long awaited zseano methodology v2. Right now, all of the content on this website is considered out-dated, however our members section continues to operate for members.
Stay tuned for updates coming soon!
FirstBlood-#392 — [COLLAB with isitbug] Still able to modify email on appointment
This issue was discovered on FirstBlood v2
On 2021-10-25, shreky Level 4 reported:
Getting started
Learn about vulnerability types 
Getting started in bug bounties 
Test your knowledge
Free Web Application Challenges
Guides for your hunts 
ZSeano's Methodology
Effective Note Taking for bug bounties
Useful Resources 
Disclosed HackerOne Reports 
Our community
Endorsed Members
Hackevents 
Member Articles
Summary
When modifying an appointment,its specified that For safeguarding reasons you are only able to modify certain information about your appointment. which only limits the user to modify their message.Previously it was found that the email field could also be modified if the doctorAuthed cookie is set,and that still hasn't changed.
Update: Apart from this,after cancelling an appointment,it's still possible to modify its message via the ma.php endpoint and the changes will be shown on /drpanel/cancelled.php.
Steps to reproduce
- Make an appointment
- Modify your appointment and add
email=changed as an additional POST parameter in the request
- The email is gonna get changed too
Impact
Disobeying the following: For safeguarding reasons you are only able to modify certain information about your appointment.(message)
POST Request with added email parameter -->
PoC of changed email -->
P3 Medium
Endpoint: /ma.php
Parameter: email
Payload: changed
FirstBlood ID: 33
Vulnerability Type: Application/Business Logic
Our mistake: We did not intentionally leave the code to change emails if the correct values were set, however it created interesting results because most discovered this but missed bug ID 20 and 21 and whilst it was not possible to modify via integer, if the ID was known it would still work.