We are getting close to releasing BugBountyHunter v2 which will introduce a brand new website, including member platforms, new features, challenges, guides, videos, and the long awaited zseano methodology v2. Right now, all of the content on this website is considered out-dated, however our members section continues to operate for members.
Stay tuned for updates coming soon!
FirstBlood-#875 — SQL Injection in vaccine management login can be used to view appointment details table
This issue was discovered on FirstBlood v2
On 2021-10-29, sumyth Level 2 reported:
Getting started
Learn about vulnerability types 
Getting started in bug bounties 
Test your knowledge
Free Web Application Challenges
Guides for your hunts 
ZSeano's Methodology
Effective Note Taking for bug bounties
Useful Resources 
Disclosed HackerOne Reports 
Our community
Endorsed Members
Hackevents 
Member Articles
Hi,
Please find a brief description of the vulnerability below,
Summary
Using the SQLi identified in FirstBlood-#873, it is possible to fully enumerate the backend database and view sensitive information stored in appointments table.
Steps to Reproduce:
- Utilize the SQLi identified in FirstBlood-#873 and launch SQLMap. It is observed that database 'firstblood' has a table named 'appointments'.
- The appointments table can be further dumped to reveal sensitive details with regards to appoints made by patients. The information include allergies, contact details, addresses etc.
The disclosed appointment IDs can also be utilized to modify appointments by any user as well.
Impact
Using SQLi, an attacker can gain access to the extremely sensitive PII data of patients and also modify their appoints using appointment IDs disclosed.
P1 CRITICAL
Endpoint: /vaccination-manager/login.php
Parameter: password
Payload: NA
FirstBlood ID: 30
Vulnerability Type: SQL Injection
There is an SQL injection on the vaccination management portal login page which results in the user being able to login as the administrator.