FirstBlood-#77 — PII disclosure using GET request
This report has been reviewed and accepted as a valid vulnerability on FirstBlood!
On 2021-05-09, thefawsec reported:
An administrator can enter the name of a patient (or just a few characters as they will return all matching results) and get the informtaion about them. I was able to get that information without being logged in as administrator by simply changing the POST method to GET.
- Simply visit the following endpoint:
- You will get all patients having the input characters (
sea) in their name.
How I was able to find that?
- Using provided
Admin creds, I loged in and searched for a user.
- Intercepted this request in burp.
- The request was POST and there was a cookie header having admin's cookie. I deleted the cookie, but the request failed.
- Out of curosity, changed the request from
GET and deleted the cookie again.
- Successfully got the PII of patients!
Leaking PII of patients is breach of confidentiality. This information leaked can be used against the patients in many ways. The firstblood hospital ensures the security of personal information of patients. So this is totally against the hospitals policy and claims!
This report has been publicly disclosed for everyone to view
FirstBlood ID: 12
Vulnerability Type: Auth issues
If the request method is changed from POST to GET, then the endpoint /drapi/qp.php becomes available to ANY user due to an application logic error
Respect Earnt: 1500000
is an experimental cryptocurrency based on the Ethereum blockchain with the mission to show respect to those who deserve it. We are testing it out on our FirstBlood hackevent.