FirstBlood-#590 — DrAdmin account recoverable using editpassword.php
This issue was discovered on FirstBlood v2

On 2021-10-26, mrrootsec Level 2 reported:

Description:

From the source code it reveals an function is being used to edit the User Password,Upon analyzing the behavior of that particular endpoint,it will leads to takeover the Administrator account

Steps to Reproduce the issue :

  1. Navigate to the below endpoint

    https://744d9da56e47-mrrootsec.a.firstbloodhackers.com/drpanel/drapi/editpassword.php

  2. If we observe the below code snippet , By adding some extra headers and Parameter we can retrieve the drAdmin Password 
   /* to do
    function editpassword(username) {
    var xhr = new XMLHttpRequest();
    xhr.open("POST", '', true);

Impact :

  1. As an attacker i can takeover the administrator account and also existed user password using brute-force method

Remediation / Fix:

  1. Restrict the access to this editpassword.php endpoint

Thanks and Regards

MOHAMMAD SAQLAIN

P1 CRITICAL

Endpoint: /editpassword.php

This report contains multiple vulnerabilities:

  • Auth issues
  • Auth issues

FirstBlood ID: 27
Vulnerability Type: Application/Business Logic

It is possible to edit the admins password (dradmin) from /drapi/editpassword as it's only looking for the username. Usernames can be enumerated when logging in as trying 'drAdmin' results in a different error. The username can also be found from FirstBlood v1.

FirstBlood ID: 28
Vulnerability Type: Auth issues

The endpoint /drapi/editpassword can actually be accessed unauthenticated.