FirstBlood-#394 — Modifying more information than intended on /manageappointment.php
This issue was discovered on FirstBlood v2

On 2021-10-25, newrouge Level 3 reported:

Hey, i found that patient's can change their email also in modify appointment section. Where only changing message is permitted.

Description:

  • When a patient makes and appointment there is no cookie assigned to that user.
  • Whereas a cookie is assigned to doctors i.e. doctorAuthed=eyJkb2N0b3JBdXRoIjphdXRoZWR9 which is base64 encoded {"doctorAuth":authed}
  • Now if a patient uses this cookie in his/her request they have more write permission than intended. They can change their email address along with message when modifying appointment.

steps:

  1. Make an appointment at /book-appointment.php.
  2. Note down the appointment ID, and got to /manageappointment.php and retrieve your appointment.
  3. Make some changes and click modify appointment and intercept request.

  1. Now to get more privilege ADD cookie in request doctorAuthed=eyJkb2N0b3JBdXRoIjphdXRoZWR9 and paramter [email protected]

  1. send the request.
  2. Now retrieve the appointment you will see that email is updated along with message.

Thank you

newrouge

P3 Medium

Endpoint: /manageappointment.php

Parameter: email=

Payload: cookie: doctorAuthed=eyJkb2N0b3JBdXRoIjphdXRoZWR9

FirstBlood ID: 33
Vulnerability Type: Application/Business Logic

Our mistake: We did not intentionally leave the code to change emails if the correct values were set, however it created interesting results because most discovered this but missed bug ID 20 and 21 and whilst it was not possible to modify via integer, if the ID was known it would still work.