FirstBlood-#77PII disclosure using GET request



On 2021-05-09, thefawsec reported:

Description

An administrator can enter the name of a patient (or just a few characters as they will return all matching results) and get the informtaion about them. I was able to get that information without being logged in as administrator by simply changing the POST method to GET.

POC

  1. Simply visit the following endpoint: /drpanel/drapi/qp.php?name=sea.
  2. You will get all patients having the input characters (sea) in their name.

How I was able to find that?

  1. Using provided Admin creds, I loged in and searched for a user.
  2. Intercepted this request in burp.
  3. The request was POST and there was a cookie header having admin's cookie. I deleted the cookie, but the request failed.
  4. Out of curosity, changed the request from POST to GET and deleted the cookie again.
  5. Successfully got the PII of patients!

Impact

Leaking PII of patients is breach of confidentiality. This information leaked can be used against the patients in many ways. The firstblood hospital ensures the security of personal information of patients. So this is totally against the hospitals policy and claims!

P1 CRITICAL

Endpoint: drpanel/drapi/qp.php

Parameter: name

Payload: NAME-OF-PATIENT


FirstBlood ID: 12
Vulnerability Type: Auth issues

If the request method is changed from POST to GET, then the endpoint /drapi/qp.php becomes available to ANY user due to an application logic error


Respect Earnt: 1500000
RESPECT ($RSP) is an experimental cryptocurrency based on the Ethereum blockchain with the mission to show respect to those who deserve it. We are testing it out on our FirstBlood hackevent.