FirstBlood-#618Can register as a doctor by using 'test' as invite code
This issue was discovered on FirstBlood v2.0.0 (issues patched)



On 2021-10-26, sumyth Level 2 reported:

Hi,

Please find a brief description of the vulnerability below,

Summary

It is possible to register as doctor on firstblood.com by making use of invite code 'test'. This allows an attacker to register a doctor account on the portal and access further functionalities.

Steps to Reproduce:

  1. Visit the vulnerable endpoint. Add the required username in 'username' field and provide the invite code as 'test' and submit the form.

  1. Observe that we are provided with a new set of credentials proving that the registration was successful.

  1. Use the newly provided credentials to login. We are successfully able to login at the portal.

Impact

Bypassing the invitation code by using 'test' can allow an attacker to create arbitrary accounts which can be used to impersonate as doctor and view sensitive information with regards to patients.

P3 Medium

Endpoint: register.php

Parameter: inviteCode

Payload: test


FirstBlood ID: 24
Vulnerability Type: Auth issues

The old invite code was deleted but when testing FirstBlood v2 the developers accidentally left the test code working.