FirstBlood-#838 — Regular accounts can override access to patient information
This issue was discovered on FirstBlood v2
On 2021-10-29, axe Level 4 reported:
- General account query, query failed -> Admin account query, query succeeded and its endpoint and parameters recorded -> Use general account to access the endpoint and parameters -> query succeeded!
Login to your jam account and check your patient information
Query failed, insufficient privileges
Combined with the submitted report (#id=837), login to the administrator account to query and use BURP to capture the package
Admin user query successful!!!
Log out of the Admin user, log in to the regular account Jam again, visit the
/drpanel/drapi/qp.phpendpoint, and query the Sean patient
Regular users query success!!!
- Ordinary accounts can override access to patient information(IDOR)
FirstBlood ID: 40
Vulnerability Type: Application/Business Logic
The endpoint qp.php use to respond to GET requests and it should only allow administrators to query for patient information however the developers only fixed the bug partially and it still allowed for doctors to query for patient information. query.php is related to this file and in v1 allowed for Doctors and admins, but query.php was fixed completely whereas qp.php was not.