FirstBlood-#913 — [BYPASS] Newly registered Doctor can access to PII data
This issue was discovered on FirstBlood v2

On 2021-10-30, buraaq Level 2 reported:

Hello zeano,

BYPASS for Bug ID 12

Summary

I found out newly registered Doctor can view the PII of patients through /drpanel/drapi/qp.php which they are not authorized to. It reveals sensitive full name, address, telephone number and date of birth.

Steps to reproduce
  1. Register a new doctor using "test" as invite code
  2. Do a POST request to /drpanel/drapi/qp.php with name= as body
  3. A list of patients will be returned in the response with PII data.
POC

Impact

Private data can be access by unauthorised users. This by itself is a privacy violation.

Kind regards,

buraaqsec

P3 Medium

Endpoint: /drpanel/drapi/qp.php

Parameter: name

Payload: {name}

FirstBlood ID: 40
Vulnerability Type: Application/Business Logic

The endpoint qp.php use to respond to GET requests and it should only allow administrators to query for patient information however the developers only fixed the bug partially and it still allowed for doctors to query for patient information. query.php is related to this file and in v1 allowed for Doctors and admins, but query.php was fixed completely whereas qp.php was not.