FirstBlood-#566Any user can update admin's password
This issue was discovered on FirstBlood v2

On 2021-10-26, panya Level 7 reported:

As I already reported in the site has a new endpoint /drpanel/drapi/editpassword.php now.

It allows updating any user's password (and returns the newly generated password in the response).

As we know, the admin of this site has username drAdmin, so any user could update the user password. For example via this request:

curl -X POST '' --data-raw 'username=drAdmin'

And login as the administrator.


Endpoint: /drpanel/drapi/editpassword.php

This report contains multiple vulnerabilities:

  • Auth issues
  • Auth issues

FirstBlood ID: 27
Vulnerability Type: Application/Business Logic

It is possible to edit the admins password (dradmin) from /drapi/editpassword as it's only looking for the username. Usernames can be enumerated when logging in as trying 'drAdmin' results in a different error. The username can also be found from FirstBlood v1.

FirstBlood ID: 28
Vulnerability Type: Auth issues

The endpoint /drapi/editpassword can actually be accessed unauthenticated.