FirstBlood-#488 — Able to change the email id in any appointment
This issue was discovered on FirstBlood v2
On 2021-10-25, shivam18u Level 3 reported:
I noticed that we can update the email field of any appointment if we have the
doctorAuthedcookie present in the request.
Steps to reproduce:
1) Go to manage appointment page and enter the appointment id.
2) Start burp intercept and click on Modify Appointment in browser.
3) Intercept the request and add a parameter in the request body
4) Forward the request.
You will get a success message. You can confirm by revisiting the modify appointment page.
FirstBlood ID: 33
Vulnerability Type: Application/Business Logic
Our mistake: We did not intentionally leave the code to change emails if the correct values were set, however it created interesting results because most discovered this but missed bug ID
21 and whilst it was not possible to modify via integer, if the ID was known it would still work.