FirstBlood-#551Enumerate usernames
This issue was discovered on FirstBlood v2.0.0 (issues patched)



On 2021-10-26, twsec Level 2 reported:

as mentioned before the editpassword.php function can be used by any non authenticated user to enumerate usernames and change their password at the same time thus taking over their account.

P4 Low

Endpoint: /drpanel/drapi/editpassword.php This bug makes use of the following vulnerabilities in a chain:

  • Application/Business Logic
  • Auth issues


FirstBlood ID: 27
Vulnerability Type: Application/Business Logic

It is possible to edit the admins password (dradmin) from /drapi/editpassword as it's only looking for the username. Usernames can be enumerated when logging in as trying 'drAdmin' results in a different error. The username can also be found from FirstBlood v1.

FirstBlood ID: 28
Vulnerability Type: Auth issues

The endpoint /drapi/editpassword can actually be accessed unauthenticated.

Report Feedback

@zseano

Creator & Administrator


Hi twsec, we don't have a unique bug for enumerating usernames from this endpoint so i'm going to assign ID 27 as the description mentions about user enumeration.