FirstBlood-#75 — IDOR in aptid which grants access to every appointment
This issue was discovered on FirstBlood v1.0.0
On 2021-05-09, pichik reported:
this is similiar to report
FirstBlood-#16, but with a little bit different approach.
This one will work in
http://firstbloodhackers.com/yourappointments.php. But we need to create request with burp, as original request wont pass because it require '-' in ID parameter. So by adding '-' to input field and click to retrieve appointment and catching POST request to
we can change body parameter
idto any existing appointment in this format: 5691**** and response will contain url with aptid accessible by every user
By visiting this link we get access to that appointment
Impact is critical as an attacker can see every appointment, changing email, messages and cancel it as well
FirstBlood ID: 5
Vulnerability Type: Insecure direct object reference
The endpoint QA.php (to query for an appointment) will allow for integer values to be used when querying for appointments. A bad cause of security through obscurity was attempted.