FirstBlood-#804 — Patient data can be accessed by Non Admin doctors
This issue was discovered on FirstBlood v2
On 2021-10-28, shivam18u Level 3 reported:
Getting started
Learn about vulnerability types 
Getting started in bug bounties 
Test your knowledge
Free Web Application Challenges
Guides for your hunts 
ZSeano's Methodology
Effective Note Taking for bug bounties
Useful Resources 
Disclosed HackerOne Reports 
Our community
Endorsed Members
Hackevents 
Member Articles
Hi Sean,
I found that the patient data can be accessed by a non admin doctor by sending a POST request to /drpanel/drapi/qp.php with parameter name.
The header Content-Type: application/x-www-form-urlencoded must be present in the request.
Non Admin doctor should not be able to fetch this data.
Have a nice day!
P3 Medium
Endpoint: /drpanel/drapi/qp.php
Parameter: name
Payload: .
FirstBlood ID: 40
Vulnerability Type: Application/Business Logic
The endpoint qp.php use to respond to GET requests and it should only allow administrators to query for patient information however the developers only fixed the bug partially and it still allowed for doctors to query for patient information. query.php is related to this file and in v1 allowed for Doctors and admins, but query.php was fixed completely whereas qp.php was not.