FirstBlood-#813 — Appointment data can still be modified when upon adding a cookie
This issue was discovered on FirstBlood v2.0.0 (issues patched)
On 2021-10-28, 0xblackbird reported:
Hi! I can see that users are still allowed to modify more data than they actually should be able to modify by just adding a cookie to their request.
Steps to reproduce:
- First of all, navigate to
/book-appointment.phpand fill in all the required fields. Click on Book Appointment.
- Next, copy your appointment ID and go to
/yourappointments.php. Paste in the ID in the appointment ID field and click on Retrieve Appointment.
- Now click on Modify Appointment and intercept this request. Add the following cookie:
doctorAuthed=eyJkb2N0b3JBdXRoIjphdXRoZWR9and for example edit the email-address.
- Forward the request and go back to your appointment. You'll see that the email-address has changed.
fName, lName, email, ...
FirstBlood ID: 33
Vulnerability Type: Application/Business Logic
Our mistake: We did not intentionally leave the code to change emails if the correct values were set, however it created interesting results because most discovered this but missed bug ID
21 and whilst it was not possible to modify via integer, if the ID was known it would still work.