BugBountyHunter

After some recon I found that the new feature (vaccination-manager) has a login page located at /vaccination-manager/login.php.

The form allows enumerating registered users (because it returns an error "User does not exist" for an unregistered username). I tried username "admin" and it indeed registered (returns "Invalid username or password" for a random password).

But the password field value is vulnerable to SQL injection.

So to bypass the login form and logging-in as admin, we can use this payload as the admin user's password field value: test' or 1=1#

Impact:

An attacker could log in to the vaccination manager portal as admin. Also, the attacker could exfiltrate data from this database, with sqlmap, for example using this command:

sqlmap -u 'https://7f2942c64ee8-panya.a.firstbloodhackers.com/vaccination-manager/login.php' --data 'username=admin&password=test'  --dbms MySQL --technique B --dump -D firstblood