FirstBlood-#414 — Email value in Modify Appointment Form is still changable
This issue was discovered on FirstBlood v2.0.0 (issues patched)
On 2021-10-25, kinako reported:
Dear FirstBlood security team, I found a vulnerability on your service. I hope this report will help you.
Modify Appointment Form, it says
For safeguarding reasons you are only able to modify certain information about your appointment. It includes that we cannot change email value, but actually we can change.
First of all, create an appointment and in this case I set
MODIFY APPOINTMENTbutton and capture the HTTP request.
If we add an additional param named
This seems unintended behavior for firstblood because of
For safeguarding reasons...message.
- malicious patients can modify their email address
- actually this is a same bug in firstblood v1, forget to patch?
FirstBlood ID: 33
Vulnerability Type: Application/Business Logic
Our mistake: We did not intentionally leave the code to change emails if the correct values were set, however it created interesting results because most discovered this but missed bug ID
21 and whilst it was not possible to modify via integer, if the ID was known it would still work.