FirstBlood-#875 — SQL Injection in vaccine management login can be used to view appointment details table
This issue was discovered on FirstBlood v2

On 2021-10-29, sumyth Level 2 reported:

Hi,

Please find a brief description of the vulnerability below,

Summary

Using the SQLi identified in FirstBlood-#873, it is possible to fully enumerate the backend database and view sensitive information stored in appointments table.

Steps to Reproduce:

  1. Utilize the SQLi identified in FirstBlood-#873 and launch SQLMap. It is observed that database 'firstblood' has a table named 'appointments'.

  1. The appointments table can be further dumped to reveal sensitive details with regards to appoints made by patients. The information include allergies, contact details, addresses etc.

The disclosed appointment IDs can also be utilized to modify appointments by any user as well.

Impact

Using SQLi, an attacker can gain access to the extremely sensitive PII data of patients and also modify their appoints using appointment IDs disclosed.

P1 CRITICAL

Endpoint: /vaccination-manager/login.php

Parameter: password

Payload: NA

FirstBlood ID: 30
Vulnerability Type: SQL Injection

There is an SQL injection on the vaccination management portal login page which results in the user being able to login as the administrator.