FirstBlood-#566Any user can update admin's password
This issue was discovered on FirstBlood v2.0.0 (issues patched)



On 2021-10-26, panya Level 7 reported:

As I already reported in https://www.bugbountyhunter.com/hackevents/report?id=386 the site has a new endpoint /drpanel/drapi/editpassword.php now.

It allows updating any user's password (and returns the newly generated password in the response).

As we know, the admin of this site has username drAdmin, so any user could update the user password. For example via this request:

curl -X POST 'https://3ebb87898d31-panya.a.firstbloodhackers.com/drpanel/drapi/editpassword.php' --data-raw 'username=drAdmin'

And login as the administrator.

P1 CRITICAL

Endpoint: /drpanel/drapi/editpassword.php This bug makes use of the following vulnerabilities in a chain:

  • Auth issues
  • Auth issues


FirstBlood ID: 27
Vulnerability Type: Application/Business Logic

It is possible to edit the admins password (dradmin) from /drapi/editpassword as it's only looking for the username. Usernames can be enumerated when logging in as trying 'drAdmin' results in a different error. The username can also be found from FirstBlood v1.

FirstBlood ID: 28
Vulnerability Type: Auth issues

The endpoint /drapi/editpassword can actually be accessed unauthenticated.