New doctor can query patients information by API endpoint.

FirstBlood-#766 — New doctor can query patients information by API endpoint.
This issue was discovered on FirstBlood v2

This report has been reviewed and accepted as a valid vulnerability on FirstBlood!

On 2021-10-28, newrouge Level 3 reported:


Hey, i found that new doctors can query patients information by direct requesting to API endpoint and beats the application logic.


New doctors can't search for patients information from dashboard.



But when an admin search for the patient info, following request is made to drpanel/drapi/qa.php.



Let's try to make an request from new doctor account to same endpoint.



And we get every patient data, although in dashboard new doctors aren't allowed to search for that.


It's a authorization issue that need to be fixed.
Thank you
newrouge

This report has been publicly disclosed for everyone to view

P3 Medium

Endpoint: /drpanel/drapi/qp.php

Parameter: name=

Payload: N/A

FirstBlood ID: 40
Vulnerability Type: Application/Business Logic

The endpoint qp.php use to respond to GET requests and it should only allow administrators to query for patient information however the developers only fixed the bug partially and it still allowed for doctors to query for patient information. query.php is related to this file and in v1 allowed for Doctors and admins, but query.php was fixed completely whereas qp.php was not.

BugBountyHunter