FirstBlood-#474[COLLAB with isitbug] Able to change doctor passwords via admin API that is accessible by any doctor
This issue was discovered on FirstBlood v2

On 2021-10-25, shreky Level 5 reported:

Correction to title --> THE API IS ACCESSIBLE BY ANYONE


In the source code of /drpanel/index.php there is the following code snippet:

/* to do
 function editpassword(username) {
 var xhr = new XMLHttpRequest();"POST", '', true);
 xhr.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");

 xhr.onreadystatechange = function() {
     if (this.readyState === XMLHttpRequest.DONE && this.status === 200) {
         } else {


 } */

Which suggests that there is a function to edit the password of accounts,however the endpoint is not shown to us not even if we're admin(tested after I logged in as admin user).Through absolute guessing on the first try I found the endpoint /drpanel/drapi/editpassword.php which was returning blank,changing it to POST and adding the parameter username as the code suggests,it successfully changed the password of the user drAdmin.

Steps to reproduce

  1. Make a POST request to /drpanel/drapi/editpassword.php with the POST parameter username=drAdmin
  2. The server will respond with the new password of the user


ANY USER is able to update the password of any doctor/admin if their username is known which leads to the takeover of their account and if they're admin for example drAdmin,they get full access as admin.

Request PoC(notice there's NO cookies set) -->


Endpoint: /drpanel/drapi/editpassword.php

This report contains multiple vulnerabilities:

  • Auth issues
  • Auth issues

FirstBlood ID: 27
Vulnerability Type: Application/Business Logic

It is possible to edit the admins password (dradmin) from /drapi/editpassword as it's only looking for the username. Usernames can be enumerated when logging in as trying 'drAdmin' results in a different error. The username can also be found from FirstBlood v1.

FirstBlood ID: 28
Vulnerability Type: Auth issues

The endpoint /drapi/editpassword can actually be accessed unauthenticated.