Description

An administrator can enter the name of a patient (or just a few characters as they will return all matching results) and get the informtaion about them. I was able to get that information without being logged in as administrator by simply changing the POST method to GET.

POC

1. Simply visit the following endpoint: /drpanel/drapi/qp.php?name=sea.
2. You will get all patients having the input characters (sea) in their name.

How I was able to find that?

1. Using provided Admin creds, I loged in and searched for a user.
2. Intercepted this request in burp.
3. The request was POST and there was a cookie header having admin's cookie. I deleted the cookie, but the request failed.
4. Out of curosity, changed the request from POST to GET and deleted the cookie again.
5. Successfully got the PII of patients!

Impact

Leaking PII of patients is breach of confidentiality. This information leaked can be used against the patients in many ways. The firstblood hospital ensures the security of personal information of patients. So this is totally against the hospitals policy and claims!