Registering as Doctor by using `Test` as invite code

**You are viewing our old website - new website soon...!**

We are getting close to releasing BugBountyHunter v2 which will introduce a brand new website, including member platforms, new features, challenges, guides, videos, and the long awaited zseano methodology v2. Right now, all of the content on this website is considered out-dated, however our members section continues to operate for members.

Stay tuned for updates coming soon!

FirstBlood-#856 — Registering as Doctor by using `Test` as invite code
This issue was discovered on FirstBlood v2

This report has been reviewed and accepted as a valid vulnerability on FirstBlood!

On 2021-10-29, th4nu0x0 Level 2 reported:


        Summary:
To register  account on First Blood we need a Unique invite code which is not available for normal users but using Test as code anyone can create a Doctor account.
Steps To Reproduce:

GoTo https://firstbloodhackers.com/register.php
Enter a username and on invite code enter Test and you'll be presented with your username and password

Impact:
Registering Doctor account with test code

This report has been publicly disclosed for everyone to view

P3 Medium

Endpoint: /register.php

Parameter: /register.php

Payload: Test

FirstBlood ID: 24
Vulnerability Type: Auth issues

The old invite code was deleted but when testing FirstBlood v2 the developers accidentally left the test code working.