Any user can update admin's password

FirstBlood-#566 — Any user can update admin's password
This issue was discovered on FirstBlood v2

This report has been reviewed and accepted as a valid vulnerability on FirstBlood!

On 2021-10-26, panya Level 7 reported:


As I already reported in https://www.bugbountyhunter.com/hackevents/report?id=386 the site has a new endpoint /drpanel/drapi/editpassword.php now.
It allows updating any user's password (and returns the newly generated password in the response).
As we know, the admin of this site has username drAdmin, so any user could update the user password. For example via this request:
curl -X POST 'https://3ebb87898d31-panya.a.firstbloodhackers.com/drpanel/drapi/editpassword.php' --data-raw 'username=drAdmin'
And login as the administrator.

This report has been publicly disclosed for everyone to view

P1 CRITICAL

Endpoint: /drpanel/drapi/editpassword.php

This report contains multiple vulnerabilities:

Auth issues
Auth issues

FirstBlood ID: 27
Vulnerability Type: Application/Business Logic

It is possible to edit the admins password (dradmin) from /drapi/editpassword as it's only looking for the username. Usernames can be enumerated when logging in as trying 'drAdmin' results in a different error. The username can also be found from FirstBlood v1.

FirstBlood ID: 28
Vulnerability Type: Auth issues

The endpoint /drapi/editpassword can actually be accessed unauthenticated.

BugBountyHunter