FirstBlood-#414 — Email value in Modify Appointment Form is still changable
This issue was discovered on FirstBlood v2

On 2021-10-25, kinako Level 5 reported:

Dear FirstBlood security team, I found a vulnerability on your service. I hope this report will help you.

Summary

In Modify Appointment Form, it says For safeguarding reasons you are only able to modify certain information about your appointment. It includes that we cannot change email value, but actually we can change.

Vulnerability Description(PoC)

First of all, create an appointment and in this case I set Patient Email as [email protected].

Next, click MODIFY APPOINTMENT button and capture the HTTP request.

If we add an additional param named email and set a value with a valid doctorAuthed Cookie, then it's reflected!!

This seems unintended behavior for firstblood because of For safeguarding reasons... message.

Impact

  • malicious patients can modify their email address
  • actually this is a same bug in firstblood v1, forget to patch?

Regards, kinako

P3 Medium

Endpoint: /manageappointment.php

Parameter: email

Payload: [email protected]

FirstBlood ID: 33
Vulnerability Type: Application/Business Logic

Our mistake: We did not intentionally leave the code to change emails if the correct values were set, however it created interesting results because most discovered this but missed bug ID 20 and 21 and whilst it was not possible to modify via integer, if the ID was known it would still work.