Hackevents FirstBlood - Live Hacker Challenge

Event Changes

We have added a new bug type as requested by members, deserialization and there will be a bounty bonus for the first finder!

We are changing bounty payouts for this event and whilst first finds will be awarded we want to you not feel like you need to rush to report. TAKE YOUR TIME, no need to rush, enjoy the experience! Leave the bounty paying to us! ;-)

After the event ends and all bugs are revealed there will be extra information detailing more about the patch used.

Scope: 'FirstBloodHackers' (version 2.0)

Please note the parts of text below (describing the web app) and information on our web application is satire.

"FirstBlood" is a hospital that understands and care for everyone. Yes, everyone.

The world is a beautiful place, and so are you. Humans are so gifted we possess the ability to spread & share love which as a result makes others' feel good. Isn't that amazing?! We embrace love here at FirstBloodHackers and make sure you are looked after and we'll do our best to hack you back on track! Spread a little love today.

Version 2.0.0 - Issues patched!

From us at the team of FirstBloodHackers, we want to thank you so much for your help on FirstBlood v1.0.0! We believe we've addressed all of the issues and we're keen for you to re-test our website to make sure we've patched issues correctly! We've also released our new vaccine management system which we're eager for you to play with!

Available functionality

NEW FEATURE! Vaccine Upload: Upload proof of your vaccination for us to store in our vaccine management system.

HackerCamps: "Fixing HackerBack".
Hackers are known to spend long periods of time on their computers, sometimes (okay, quite a lot!) slouching with bad posture. Overtime this can cause what we call, HackerBack, which is where your back is craving a good ole massage and a rest from hacking.

Book and manage your appointment with us safely and securely. Let us know your allergies so we can do our best to look after you. If you are unable to make your appointment then please make sure to cancel your appointment. We don't like it when people appointments and do not let us know.

Credentials available

No credentials are available this time for FirstBlood v2.0.0 as we're still doing some testing on this.

A helping hand (this is not satire!)

This hackevent is all about teaching you to read disclosed reports and testing the patch. Navigating the web app and putting yourself in the other hackers shoes and being where they were. From here you should consider how the issue is fixed and what may of been done incorrectly or forgotten due to an oversight.

This event is also a bit of a "puzzle" and some things may lead onto another. For example if you potentially discovered an SQL injection vulnerability then you should by all means exploit it to maybe go further.

Remember, you are okay to scan for files/directories but just be wary on why you're running them and what you're maybe trying to find. When we say "no automated scanners", we mean not just running a Nessus scan and sitting back.

Report Title	Severity	Researcher	Type	Respect
Reflective XSS on login.php via goto parameter	Medium	panya Level 7	Reflective XSS	0
Admin Panel Exposure by old credentials	Informative	newrouge Level 3	Authorisation Issue	0
[COLLAB with isitbug] XSS Bypassed	Medium	shreky Level 4	Reflective XSS	20
Reflective XSS via ref parameter on register.php	Medium	panya Level 7	Reflective XSS	0
[COLLAB with isitbug] Reflected XSS bypassed	Medium	shreky Level 4	Reflective XSS	10
File Enumeration inside /api/checkproof.php?proof=file:///etc/passwd	Low	neolex Level 2	Info leak	0
[COLLAB with isitbug] Old admin credentials still work	Informative	shreky Level 4	Authorisation Issue	0
Test user can query all patients	Medium	0x1452 Level 3	Application/Business Logic	0
Valid doctor credentials could be obtained without an invitation code	Medium	panya Level 7	Authorisation Issue	0
XSS bypass on cancel report	High	buraaq Level 2	Stored XSS	0
[COLLAB with isitbug] Reflected XSS via message on cancelled appointment	High	shreky Level 4	Stored XSS	0
Referer header reflection leads to Reflective XSS	Medium	kinako Level 5	Reflective XSS	30
Reflective XSS on login.php via goto parameter after successful login	Medium	panya Level 7	Reflective XSS	0
rXSS at /register.php	Medium	0x1452 Level 3	Reflective XSS	0
register.php is still vulenerable to Reflective XSS	Medium	kinako Level 5	Reflective XSS	0
Open Redirect on /logout.php	Low	0x1452 Level 3	Open Redirect	0
Open redirect via ref parameter on /drpanel/logout.php endpoint	Low	panya Level 7	Open Redirect	0
Admin access is still possible	Informative	twsec Level 2	Authorisation Issue	0
rXSS on login.php leads to account takeover	Medium	0x1452 Level 3	Reflective XSS	0
Stored XSS via message parameter on manageappointment.php endpoint	High	panya Level 7	Stored XSS	0
Reflected XSS on register.php through the ref parameter [Bypass]	Medium	holybugx Level 5	Reflective XSS	0
Error-based SQL injection	CRITICAL	r0x61tremy Level 3	SQL Injection	0
Unique invite code bypass	Medium	vigilante Level 4	Authorisation Issue	0
Easily guessed invited code on doctor register	Medium	neolex Level 2	Authorisation Issue	0
logout.php is still vulnearble to Open Redirect	Low	kinako Level 5	Open Redirect	0
Edit password functionality can be used to reset password of any user	CRITICAL	sumyth Level 2	Auth issues	10
Any user can update another's user password via /drpanel/drapi/editpassword.php endpoint	CRITICAL	panya Level 7	Authorisation Issue	0
[COLLAB with isitbug] Still able to modify email on appointment	Medium	shreky Level 4	Application/Business Logic	0
Modifying more information than intended on /manageappointment.php	Medium	newrouge Level 3	Application/Business Logic	0
Stored XSS found on /manageappointment.php?success&aptid={id}	High	d20s84 Level 3	Stored XSS	0
Stored XSS on /manageappointment.php using the message parameter [Bypass]	High	holybugx Level 5	Stored XSS	0
Reflected XSS at Register.php	Medium	mrrootsec Level 2	Reflective XSS	0
Able to change any username's password without login (including drAdmin)	CRITICAL	0xconft Level 5	Auth issues	0
Open redirect at https://62f9cb44c755-0xconft.a.firstbloodhackers.com/drpanel/logout.php?ref=//http:evil.org	Low	0xconft Level 5	Open Redirect	0
email value in Modify Appointment Form is still changable	Medium	kinako Level 5	Application/Business Logic	10
Un-Authorized users can access "/drpanel/drapi/qp.php" endpoint and access users personal information	Medium	c3phas Level 4	Application/Business Logic	30
Email of an appointment could be modified if cookie doctorAuthed is present	Medium	panya Level 7	Application/Business Logic	0
Reflective XSS on login.php	Medium	shivam18u Level 3	Reflective XSS	0
Stored XSS on the /manageappointment.php endpoint when canceling an appointment	High	johandu97 Level 4	Stored XSS	0
Stored XSS in cancelled appointments message functionality	High	sumyth Level 2	Stored XSS	0
Reflective XSS at /login.php	Medium	d20s84 Level 3	Reflective XSS	0
Reflective xss on register.php with user interaction	Medium	shivam18u Level 3	Reflective XSS	0
Open Redirect on login page with "goto" parameter leading to account takeover	Medium	xnl-h4ck3r Level 4	Reflective XSS	10
A doctors invite code is easily guessable and grants anyone access to the doctor portal and patient PII data	Medium	xnl-h4ck3r Level 4	Authorisation Issue	0
Anyone can register as a doctor due to weak Invite key	Medium	newrouge Level 3	Authorisation Issue	0
Reflected XSS on the /login.php endpoint with the goto vulnerable parameter	Medium	johandu97 Level 4	Reflective XSS	0
goto parameter is still vulnerable to Reflective XSS	Medium	kinako Level 5	Reflective XSS	10
[COLLAB with isitbug] Invite code is literally "test"	Medium	shreky Level 4	Authorisation Issue	10
Reflected XSS on the /register.php endpoint with the ref vulnerable parameter	Medium	johandu97 Level 4	Reflective XSS	0
normal doctor can update other users' password	CRITICAL	kinako Level 5	Authorisation Issue	0
A User can modify the Email of their appointment despite being disabled for safeguarding reasons	Medium	xnl-h4ck3r Level 4	Application/Business Logic	0
[COLLAB with isitbug] Blind LFI on /api/checkproof.php	Low	shreky Level 4	Info leak	20
RCE at https://62f9cb44c755-0xconft.a.firstbloodhackers.com/api/checkproof.php	CRITICAL	0xconft Level 5	Deserialization	0
[COLLAB with itisbug] Non admin doctor can search patients through api	Medium	shreky Level 4	Application/Business Logic	0
[unpatched]Reflective XSS on /login.php?action=login&ref={payload}	Medium	d20s84 Level 3	Reflective XSS	0
[COLLAB] Reflected XSS via login endpoint	Medium	amec0e Level 3	Reflective XSS	0
Reflected XSS at Login.php	Medium	mrrootsec Level 2	Reflective XSS	0
[COLLAB with isitbug] Stored XSS via cancelled appointment's message that executes on doctors	High	shreky Level 4	Stored XSS	30
Reflected XSS on register.php with ref parameter, leaking cookies (requires interaction)	Medium	xnl-h4ck3r Level 4	Reflective XSS	0
Cancelled Appintments is still vulnerable to Stored XSS	High	kinako Level 5	Stored XSS	10
Reflected XSS on /login.php through the "goto" parameter leading to ATO	Medium	holybugx Level 5	Reflective XSS	10
[COLLAB with isitbug] Open redirect bypass on logout	Low	shreky Level 4	Open Redirect	0
[COLLAB with isitbug] Able to change doctor passwords via admin API that is accessible by any doctor	CRITICAL	shreky Level 4	Auth issues	30
[COLLAB] RCE via insecure deserialization in /api/checkproof.php endpoint	CRITICAL	panya Level 7	Information leak/disclosure	60
Reflected XSS on /login.php via goto parameter leads to account takeover	Medium	0xblackbird Level 5	Reflective XSS	10
Reflective xss vis 'goto=' parmater on login.php	Medium	newrouge Level 3	Reflective XSS	0
Reflected XSS on /login.php using "goto" parameter and javascript scheme	Medium	holybugx Level 5	Reflective XSS	10
Able to register account using invite code "test"	Medium	shivam18u Level 3	Authorisation Issue	0
Able to change password of any account (admin account access)	CRITICAL	shivam18u Level 3	Auth issues	0
login as Admin	CRITICAL	twsec Level 2	Authorisation Issue	0
Able to change the email id in any appointment	Medium	shivam18u Level 3	Application/Business Logic	0
parameter "ref" at endpoint /register.php is vulnerable to reflected XSS.	Medium	vishal Level 2	Reflective XSS	0
Stored XSS through the appointments cancelation message leads to ATO	High	holybugx Level 5	Stored XSS	0
Stored XSS on /drpanel/cancelled.php can lead to admin account takeover	High	shivam18u Level 3	Stored XSS	0
Enumerating files/directories and tools/binaries installed on FirstBlood server	Low	newrouge Level 3	Info leak	10
Endpoint allows unauthorized users to update other user's passwords	CRITICAL	0xblackbird Level 5	Auth issues	10
Several Information leakage through vaccination proof list	CRITICAL	holybugx Level 5	Info leak	0
weak unique invite code for registering doctor account	Medium	0xconft Level 5	Authorisation Issue	0
New registered doctor account can query patient directly via POST https://a9381b5eb20c-0xconft.a.firstbloodhackers.com/drpanel/drapi/qp.php	Medium	0xconft Level 5	Application/Business Logic	0
Can update any users password if know the username, and therefore takeover any account and get Admin access	CRITICAL	xnl-h4ck3r Level 4	Auth issues	0
non-admin doctor account can use qp.php API	Medium	kinako Level 5	Application/Business Logic	0
Account takeover via /drpanel/drapi/editpassword.php	CRITICAL	0x1452 Level 3	Auth issues	0
POST-based rXSS on login.php	Medium	0x1452 Level 3	Reflective XSS	0
Stored XSS on /manageappointment.php	High	0x1452 Level 3	Stored XSS	0
Stored XSS on /cancelled.php	High	0x1452 Level 3	Stored XSS	0
Open Redirect on /drpanel/logout.php?ref=	Low	th4nu0x0 Level 2	Open Redirect	0
Anyone can register as doctor by giving invite code "test"	Medium	vishal Level 2	Authorisation Issue	0
The ref parameter is redirectable in the register.php path	Informative	axe Level 4	Open Redirect	0
Modify Appointment Form is vulnerable to Stored XSS	High	kinako Level 5	Stored XSS	10
Test Credentials are still working	Medium	d20s84 Level 3	Authorisation Issue	0
Environment Files Exposed Publicly	High	mrrootsec Level 2	Info leak	20
Reflected XSS on /register.php using ref parameter	Medium	th33phoenix Level 4	Reflective XSS	0
[Unpatched] Patient's information can be changed that is not allowed to change by the webapp	Medium	d20s84 Level 3	Application/Business Logic	0
goto paramerter at /login.php vulnerable to reflective xss.	Medium	vishal Level 2	Reflective XSS	0
enumerate usernames	Low	twsec Level 2	Application/Business Logic	0
Modifying information on Appointment Form which are not allowed to be modified.	Medium	th4nu0x0 Level 2	Application/Business Logic	0
Admin password can be changed and retained by anyone	CRITICAL	d20s84 Level 3	Auth issues	0
XSS on internet explorer in the login page using the referer header	Medium	sumzer0 Level 2	Reflective XSS	10
Stored xss leads to doctor / admin account takeover	High	thecast Level 3	Stored XSS	20
a normal user can change the message in an appointment of another user	Medium	twsec Level 2	Insecure direct object reference	0
RCE via PHAR deserialization on /api/checkproof.php	CRITICAL	0x1452 Level 3	Deserialization	10
DOM Based XSS via redirection to javascript uri	Medium	neolex Level 2	Reflective XSS	0
open redirect inside drpanel/logout.php endpoint	Low	neolex Level 2	Open Redirect	0
Reflected XSS inside ref parameter on /register.php	Medium	neolex Level 2	Reflective XSS	0
Any user can update admin's password	CRITICAL	panya Level 7	Auth issues	0
patient can change his email when he's not supposed to	Medium	twsec Level 2	Application/Business Logic	0
Default credentials allow any unauthorized user to get access to a doctor account	Medium	0xblackbird Level 5	Authorisation Issue	0
Applogic at Modifying Appointment Details	Medium	mrrootsec Level 2	Application/Business Logic	0
Application Logic flaw leads to anyone registering a doctor account without invite code	Medium	th33phoenix Level 4	Authorisation Issue	0
Reflective XSS on /login.php?goto=	Medium	th4nu0x0 Level 2	Reflective XSS	0
Unauthorized access to edit password API leading to Account Takeover	CRITICAL	holybugx Level 5	Auth issues	0
Reflective XSS via Referer on login.php endpoint	Medium	panya Level 7	Reflective XSS	60
Admin account takeover	CRITICAL	newrouge Level 3	Authorisation Issue	0
Open Redirect on logout.php endpoint [Bypass]	Low	holybugx Level 5	Open Redirect	10
Important files leaking on firstblood	High	newrouge Level 3	Info leak	0
drAdmin account recoverable using editpassword.php	CRITICAL	mrrootsec Level 2	Auth issues	0
register a doctor	Medium	twsec Level 2	Authorisation Issue	0
IE-only Reflected XSS	Medium	r0x61tremy Level 3	Reflective XSS	50
SQL Injection on /vaccination-manager/login.php through password parameter	CRITICAL	holybugx Level 5	SQL Injection	50
DOM-based XSS on /login.php via the goto parameter	Medium	0xblackbird Level 5	Reflective XSS	10
Open redirect on /login.php via the goto parameter	Medium	0xblackbird Level 5	Reflective XSS	10
Stored XSS through the file upload and unsanitized User-Agent	High	holybugx Level 5	Stored XSS	0
[COLLAB] Can register as a doctor and steal token upon login.	High	amec0e Level 3	Reflective XSS	0
A chain of two open redirects to leak some users token	High	c3phas Level 4	Reflective XSS	10
[COLLAB] DOM XSS on register patch bypass	Medium	amec0e Level 3	Reflective XSS	0
Can register as a doctor by using 'test' as invite code	Medium	sumyth Level 2	Authorisation Issue	0
PII Information leaked to newly registered Doctor	Medium	sumyth Level 2	Application/Business Logic	0
Insecure Deserialization leading to RCE [COLLAB]- mrrootsec	CRITICAL	newrouge Level 3	Deserialization	0
Reflected XSS in register.php page	Medium	sumyth Level 2	Reflective XSS	0
Reflected XSS on Login.php goto parameter	Medium	sumyth Level 2	Reflective XSS	0
Admin account takeover by password reset	CRITICAL	buraaq Level 2	Authorisation Issue	0
[COLLAB] RCE using insecure deserialization	CRITICAL	shivam18u Level 3	Deserialization	10
drAdmin ATO by using doctor account.	CRITICAL	vishal Level 2	Auth issues	0
Referer Based XSS on /login.php endpoint leading to ATO	Medium	holybugx Level 5	Reflective XSS	70
stored xss in message left at the time of cancelation of appointment.	High	vishal Level 2	Stored XSS	0
[COLLAB with isitbug] Information disclosure on multiple API endpoints	CRITICAL	shreky Level 4	Info leak	30
[COLLAB] Stored XSS on Cancel appointment which leads to ATO	High	amec0e Level 3	Stored XSS	0
Stored XSS when cancelling an appointement triggered in doctor panel	High	neolex Level 2	Stored XSS	0
Account takeover by overwriting user's password	Medium	neolex Level 2	Authorisation Issue	0
It is possible to reset drAdmin's password	CRITICAL	vigilante Level 4	Auth issues	0
Stored xss by meesage field on MANAGE APPOINTMENT	High	newrouge Level 3	Stored XSS	0
Vaccination proof leak	CRITICAL	shivam18u Level 3	Info leak	0
Leaked proofs of vaccination on /vaccination-manager/api/vax-proof-list.php	CRITICAL	0x1452 Level 3	Info leak	0
[Unpatched] Stored XSS still working on admin's cancelled report panel	High	d20s84 Level 3	Stored XSS	10
0 click admin account takeover via stored xss on admin dashboard through cancel appointment.	High	newrouge Level 3	Stored XSS	10
PrivEsc to root user on firstblood through deserialisation aided by unintended disclosure of composer installation	CRITICAL	eliee Level 7	Deserialization	20
Stored XSS on vaccination-manager/portal.php	High	shivam18u Level 3	Stored XSS	0
Cancelled appointments are still accessible through /manageappointment.php endpoint	Low	holybugx Level 5	Application/Business Logic	10
Reflected xss bypass on register.php with ref paramter	Medium	newrouge Level 3	Reflective XSS	0
Root access on the web server	CRITICAL	shivam18u Level 3	RCE	0
Stored XSS through DOB	Low	eliee Level 7	Stored XSS	40
sql injection on /vaccination-manager/login.php	CRITICAL	newrouge Level 3	SQL Injection	0
[COLLAB with isitbug] RCE through file upload deserialization	CRITICAL	shreky Level 4	Deserialization	50
Bypass the invitation code and register your self as a doctor	Medium	0xsaltyhash Level 3	Authorisation Issue	0
Insecure Deserialization leading to complete server takeover + Privesc	CRITICAL	holybugx Level 5	Deserialization	170
XSS on /vaccination-manager/portal.php through User-agent pollution	High	newrouge Level 3	Stored XSS	10
Becoming a root on the server	CRITICAL	panya Level 7	RCE	40
[COLLAB]Vaccination Management portal is vulnerable to Stored XSS	High	kinako Level 5	Stored XSS	10
User's vaacination data leak and with other info without needing to log into vaccine-manger portal	CRITICAL	newrouge Level 3	Info leak	0
All vaccination proof records leaked	CRITICAL	buraaq Level 2	Info leak	0
Stored XSS on /vaccination-manager/portal.php	High	0x1452 Level 3	Stored XSS	0
Reflective XSS on register page	Medium	axe Level 4	Reflective XSS	0
Full Account takeover (even for admins)	CRITICAL	0xsaltyhash Level 3	Authorisation Issue	0
newly created dr accounts can access patient PII via search api	Medium	0xsaltyhash Level 3	Application/Business Logic	0
vaccination-management login panel can be bypassed using sql injection in password paramerter for username=admin.	CRITICAL	vishal Level 2	SQL Injection	30
New doctors unauthorized access to patients management details	Medium	holybugx Level 5	Application/Business Logic	20
Open redirect by logout.php	Low	newrouge Level 3	Open Redirect	0
Stored can be gained by giving payload in User-Agent Request header . It's fired on /vaccination-manager/portal.php.	High	vishal Level 2	Stored XSS	20
[COLLAB isitbug] SQL Injection on Vaccination Management login page leading to unauthorized access to the panel	CRITICAL	shreky Level 4	SQL Injection	20
Vaccine Login is vulnerable to SQLi	CRITICAL	buraaq Level 2	SQL Injection	10
[COLLAB with isitbug] Blind XSS through User-Agent header on Vaccination Management portal affecting admins	High	shreky Level 4	Stored XSS	20
Remote Command Execution via deserialization by uploading phar file	CRITICAL	neolex Level 2	Deserialization	0
Dangerous /drpanel/drapi/editpassword.php endpoint leading to 0 click account takeover	CRITICAL	neolex Level 2	Auth issues	0
Open Url Redirect found at /drpanel/logout.php?ref=	Low	vishal Level 2	Open Redirect	0
Posibility to modify email of any appointment via /api/ma.php endpoint if attacker know the appointment id	Medium	neolex Level 2	Application/Business Logic	0
User can upload infinite times vaccination certificate with same email leads to app/business Logic failure.	Informative	vishal Level 2	Application/Business Logic	0
User can modify appointment email address which is supposed to be not editable	Medium	sumyth Level 2	Application/Business Logic	0
[COLLAB] Phar deserialization to RCE via upload vaccination proof	CRITICAL	amec0e Level 3	Deserialization	0
XSS through hidden `goto` parameter on `/login.php`	High	eliee Level 7	Reflective XSS	0
Reflected XSS on /register.php via the ref parameter	Medium	0xblackbird Level 5	Reflective XSS	20
Session Doesn't not expire at /drpanel/index.php and /vaccination-manager/portal.php.	Low	vishal Level 2	Application/Business Logic	0
[COLLAB] Password change endpoint leads to ATO of drAdmin account.	CRITICAL	amec0e Level 3	Authorisation Issue	10
[COLLAB] Enumerate users via vaccination manager login	CRITICAL	amec0e Level 3	SQL Injection	0
[COLLAB] Exposed api allows viewing of all vaccination proof leaking user emails	CRITICAL	amec0e Level 3	Info leak	0
XSS on login page	Medium	axe Level 4	Reflective XSS	0
[COLLAB ] Session Invalidation at Vaccine Management Portal	Low	mrrootsec Level 2	Application/Business Logic	30
Reflected XSS on register.php leads to account takeover	Medium	vigilante Level 4	Reflective XSS	0
multiple server config files are accessable publicly.	High	vishal Level 2	Info leak	0
XSS in vaccine portal	High	twsec Level 2	Stored XSS	0
Rce can be obtained by uploading malicious .phar file at image field on /vaccination-manager/pub/upload-vaccination-proof.php because of vulnerable version of monolog.	CRITICAL	vishal Level 2	Deserialization	0
New doctor can query patients information by API endpoint.	Medium	newrouge Level 3	Application/Business Logic	0
finding and logging into the vaccination portal	CRITICAL	twsec Level 2	RCE	0
SQL Injection Vulnerability in Vaccine Management Portal Allow Authentication Bypass	CRITICAL	netmous3 Level 4	SQL Injection	20
No session invalidation after logout on vaccine-portal	Low	newrouge Level 3	Application/Business Logic	0
Insecure Deserialization leading to RCE and rooting the server	CRITICAL	xnl-h4ck3r Level 4	Deserialization	20
Info disclosure on /vaccination-manager/api/vax-proof-list.php	CRITICAL	xnl-h4ck3r Level 4	Info leak	0
SQLi on /vaccination-manager/login.php	CRITICAL	shivam18u Level 3	SQL Injection	0
The parameter "goto" is vulnerable to XSS on login.php.	Medium	vigilante Level 4	Reflective XSS	0
Stored XSS at /book-appointment.php	High	mrrootsec Level 2	Stored XSS	0
SQL Injection on vaccination-manager login page to access portal	CRITICAL	xnl-h4ck3r Level 4	SQL Injection	0
Stored XSS Leads to Admin Account Takeover	High	mrrootsec Level 2	Stored XSS	10
Stored XSS on Vaccination Manager Portal through User Agent	High	xnl-h4ck3r Level 4	Stored XSS	0
Unexpected registered users	Medium	axe Level 4	Authorisation Issue	0
Reflective XSS at /register.php	Medium	0xirfan Level 5	Reflective XSS	0
SQLi allows to bypass login page for the vaccination-manager portal	CRITICAL	panya Level 7	SQL Injection	0
Reflective XSS on Login page using the hidden "goto" parameter	Medium	xnl-h4ck3r Level 4	Reflective XSS	0
Reflective XSS at /login.php due to goto	Medium	0xirfan Level 5	Reflective XSS	0
Invalidate previously registered users by using duplicate invitations	Medium	axe Level 4	Authorisation Issue	0
Stored XSS via User-Agent header value in /vaccination-manager/portal.php	High	panya Level 7	Stored XSS	0
Information about vaccination proof can be accessed by any user via /vaccination-manager/api/vax-proof-list.php endpoint	CRITICAL	panya Level 7	Info leak	0
Patient data can be accessed by Non Admin doctors	Medium	shivam18u Level 3	Application/Business Logic	0
Privilege escalation when having root	CRITICAL	twsec Level 2	RCE	0
Stored XSS on /drpanel/index.php by cancelling an appointment	High	0xblackbird Level 5	Stored XSS	10
SQL Injection in vaccination manager login	CRITICAL	twsec Level 2	SQL Injection	0
An account with the same username can be created which leads to the original account being deleted and replaced with the attackers	Medium	xnl-h4ck3r Level 4	Authorisation Issue	0
Stored XSS on /manageappointment.php can lead to account takeover	High	0xblackbird Level 5	Stored XSS	10
Stored XSS on cancelled appointment can leak admin cookies	High	xnl-h4ck3r Level 4	Stored XSS	0
Appointment data can still be modified when upon adding a cookie	Medium	0xblackbird Level 5	Application/Business Logic	0
Auth issue allowing a new doctor to view all appointment details that should require admin access	Medium	xnl-h4ck3r Level 4	Application/Business Logic	0
Open Redirect on logout.php using ref parameter	Low	xnl-h4ck3r Level 4	Open Redirect	0
Reflected XSS using Referer header on /login.php	Medium	yashamin Level 2	Reflective XSS	60
Administrator endpoints can be accessed by non privileged doctor accounts which reveals sensitive patient information.	Medium	vishal Level 2	Application/Business Logic	0
vaccination manager doesnt destroy the cookie on logout	Low	twsec Level 2	Application/Business Logic	0
Original account registered with invite code get deleted after registering another account with invite code	Medium	vishal Level 2	Authorisation Issue	0
a non admin doctor can search for patients	Medium	twsec Level 2	Application/Business Logic	0
Deleted doctor account can be used to access private user information of paient	Medium	vishal Level 2	Application/Business Logic	0
Patients can still change their application email	Medium	0x1452 Level 3	Application/Business Logic	0
Open Redirect at Doctor Panel	Low	mrrootsec Level 2	Open Redirect	0
[BYPASS] Open URL Redirect on /drpanel/logout.php	Low	buraaq Level 2	Open Redirect	20
Cancel Stored XSS at the reservation function	High	axe Level 4	Stored XSS	0
patient information who have uploaded vaccination certificate is publicly exposed on endpoint /vaccination-manager/api/vax-proof-list.php	CRITICAL	vishal Level 2	Info leak	0
Change user passwords at will to enable account takeover	CRITICAL	axe Level 4	Authorisation Issue	0
Regular accounts can override access to patient information	Medium	axe Level 4	Application/Business Logic	0
All user information is leaked due to unexpired cookies	Medium	axe Level 4	Application/Business Logic	0
Open Redirect on login.php with goto parameter	Informative	xnl-h4ck3r Level 4	Reflective XSS	0
Stored XSS via cancel appointment functionality	High	panya Level 7	Stored XSS	0
Stored XSS in cancelled appointment message	High	vigilante Level 4	Stored XSS	0
stored XSS in manageappointment.php	High	twsec Level 2	Stored XSS	0
Application logic error on /drpanel/ leads to ATO of doctors who have never signed in	High	eliee Level 7	Application/Business Logic	40
[COLLAB with isitbug] Account takeover of TestDoctor with drps=%20 cookie	High	shreky Level 4	Application/Business Logic	40
Unauthorized modification of mailbox	Medium	axe Level 4	Application/Business Logic	0
stored XSS in cancelled appointment	High	twsec Level 2	Stored XSS	0
Registering as Doctor by using `Test` as invite code	Medium	th4nu0x0 Level 2	Authorisation Issue	0
Changing Anyone's Password Including drAdmin (As a Non-authenticated user)	CRITICAL	th4nu0x0 Level 2	Auth issues	0
Stored XSS on cancelled appointmnent message	High	0xirfan Level 5	Stored XSS	0
[COLLAB] Stored/Blind XSS / DOS via vaccination portal	High	amec0e Level 3	Stored XSS	0
Stored XSS on Cancel Appointment Message.	High	th4nu0x0 Level 2	Stored XSS	0
The endpoint MA.php (to modify an appointment) only allows for certain values to be modified, however due to some application logic error, if the user has tried to signup as a doctor and has the cookie "doctorAuthed" set, then it allows them to modify the email address for any appointment.	Medium	vishal Level 2	Application/Business Logic	0
Insecure Deserialization leading to Remote Code Execution	CRITICAL	c3phas Level 4	Deserialization	10
Reflected XSS on login.php using Referer header	Medium	xnl-h4ck3r Level 4	Reflective XSS	0
Swagger UI reveals unauthenticated endpoint leaking sensitive data	CRITICAL	sumyth Level 2	Information leak/disclosure	0
Username enumeration and SQL Injection on Vaccine Management login page	CRITICAL	sumyth Level 2	SQL Injection	0
New doctors can easily get access to patients private data	Medium	0xblackbird Level 5	Application/Business Logic	0
SQL Injection in vaccine management login can be used to view appointment details table	CRITICAL	sumyth Level 2	SQL Injection	0
New doctor account (limited access) can view patient information through an API call	Medium	vigilante Level 4	Application/Business Logic	0
It is possible to modify the email address of an appointment.	Medium	vigilante Level 4	Application/Business Logic	0
Broken Access Control Leads to Information Leak	Medium	mrrootsec Level 2	Application/Business Logic	0
Drpanel admin username enumeration	Low	0x1452 Level 3	Application/Business Logic	0
Doctor Role can be obtained using leaked invite code	Medium	mrrootsec Level 2	Authorisation Issue	0
SQL Injection on /vaccination-manager/login.php	CRITICAL	0x1452 Level 3	SQL Injection	10
Reflected XSS on the login form in the goto parameter	Medium	vigilante Level 4	Reflective XSS	0
Information about used dependencies is leaked via /vendor/composer/installed.json	High	panya Level 7	Info leak	0
Open redirect vulnerability in the logout function	Low	vigilante Level 4	Open Redirect	0
editpassword Function lead to ATO fore any users	High	0xirfan Level 5	Authorisation Issue	0
Open redirect via goto parameter on /login.php endpoint	Medium	panya Level 7	Reflective XSS	0
Newly Registered Doctor's can query for patient inforamtion	Medium	th4nu0x0 Level 2	Application/Business Logic	0
DOM xss found on management portal	High	vishal Level 2	Stored XSS	0
[BYPASS] Newly registered Doctor can access to PII data	Medium	buraaq Level 2	Application/Business Logic	10
The login form for Vaccination Manager is vulnerable to SQL injection	CRITICAL	vigilante Level 4	SQL Injection	0
List of vaccination disclosure	CRITICAL	vigilante Level 4	Info leak	0
FirstBlood server Rooted!	CRITICAL	newrouge Level 3	RCE	10
The User Agent parameter is vulnerable to XSS in the vaccination-manager portal.	High	vigilante Level 4	Stored XSS	0
A normal doctor still can access /drpanel/drapi/qp.php and search patients via a POST request	Medium	panya Level 7	Application/Business Logic	0
Various authentication issues	Low	panya Level 7	Application/Business Logic	0
phar out - PHP deseriliazation RCE + priv. escalation	CRITICAL	vigilante Level 4	Deserialization	0
AppLogic when registering as a doctor using invite code	Medium	mrrootsec Level 2	Authorisation Issue	0
Reflective xss on login.php by goto paramter	Medium	newrouge Level 3	Reflective XSS	0
Reflected XSS at /login.php using goto patameter leads to Account Takeover	Medium	mrrootsec Level 2	Reflective XSS	20
It is possible to login as TestDoctor with <BLANK> cookie.	High	newrouge Level 3	Application/Business Logic	0
Server misconfigurations post-RCE	CRITICAL	0x1452 Level 3	Deserialization	10
Remote Code Execution via insecure deserialization on /api/checkproof.php	CRITICAL	0xblackbird Level 5	Deserialization	20
Open redirect on logout.php	Low	0xblackbird Level 5	Open Redirect	0
Endpoint discloses information about all vaccination proof records	CRITICAL	0xblackbird Level 5	Info leak	10
[COLLAB]Vaccination Management portal is vulnerable to Stored XSS	High	mrrootsec Level 2	Stored XSS	0
[COLLAB] RCE using insecure deserialization	CRITICAL	twsec Level 2	Deserialization	0
[COLLAB]vaccination-manager Login page is vulnerable to SQL injection	CRITICAL	mrrootsec Level 2	SQL Injection	50
[COLLAB]PII leakage via vax-proof-list API	CRITICAL	mrrootsec Level 2	Info leak	10
[COLLAB]Upload Proof of Vaccination is vulnerable to RCE	CRITICAL	mrrootsec Level 2	Deserialization	60
[COLLAB] Able to modify email post booking an appointment	Medium	amec0e Level 3	Application/Business Logic	0

FirstBlood Bugs

ID	Description	Type	Found By
18	The open redirect bug on logout.php was fixed but the code still failed to filter out certain characters such as `%09` and thus the endpoint is still vulnerable to open redirect. This vulnerability only affects chrome.	`Open Redirect`	29
19	The parameter ?ref= on login.php was fixed and instead the use of `$_SERVER['HTTP_REFERER'];` was used. Patrice tested in Chrome and Firefox and saw it was secure, but some users still use Internet Explorer 10 (governments for example!) and the Referer header is vulnerable to reflective XSS.	`Reflective XSS`	12
20	Not working correctly: The endpoint QA.php was fixed to prevent the use of integer values however whilst it does not require any type of authentication to view normally, it is still vulnerable to IDOR as long as the appointmentID is known. We intended to add another feature which would allow users to convert integer > encrypted ID and this was an over sight on our behalf. This bug doesn't count towards unique finds.	`Insecure direct object reference`	1
21	Not working correctly: The endpoint MA.php was fixed to prevent the use of integer values however whilst it does not require any type of authentication to view normally, it is still vulnerable to IDOR as long as the appointmentID is known. We intended to add another feature which would allow users to convert integer > encrypted ID and this was an over sight on our behalf. This bug doesn't count towards unique finds.	`Insecure direct object reference`	4
22	Whilst an attempt was made to fix the stored XSS vulnerability in managing an appointment, it actually introduced new issues such as when creating and editing and not just when cancelling the appointment. Making use of htmlentities() and relying on .value() in javascript to encode certain characters does not prevent XSS overall. The 'fix' to this issue also results in it being vulnerable to admins on cancelled appointments as well.	`Stored XSS`	47
24	The old invite code was deleted but when testing FirstBlood v2 the developers accidentally left the test code working.	`Auth issues`	52
25	There is a reflective XSS on manageappointment.php that only works on Internet Explorer via the query string. Simply appending XSS as a parameter will reflect back. Patrice used `$_SERVER['QUERY_STRING'];` and only tested this against Chrome and Firefox.	`Reflective XSS`	0
26	The developers thought they had fixed ?goto= when reflected in an input tag on login.php from a similar bug (`ID 39`), but because this endpoint uses legacy code their changes were not applied here and thus the XSS was forgotten.	`Reflective XSS`	46
27	It is possible to edit the admins password (dradmin) from /drapi/editpassword as it's only looking for the username. Usernames can be enumerated when logging in as trying 'drAdmin' results in a different error. The username can also be found from FirstBlood v1.	`Application/Business Logic`	45
28	The endpoint /drapi/editpassword can actually be accessed unauthenticated.	`Auth issues`	20
29	When uploading a vaccine proof it is possible to achieve stored XSS against admins set via the user agent. As this value typically can't be user controlled the developers did not think it was 'worth' preventing against XSS.	`Stored XSS`	25
30	There is an SQL injection on the vaccination management portal login page which results in the user being able to login as the administrator.	`SQL Injection`	25
31	The endpoint api.php can be found under the vaccination manage portal directory which allows for user interaction and results in PII leak on vax-proof-list.php	`Information leak/disclosure`	19
32	The parameter ?ref on register.php was poorly fixed and can be bypassed in various ways. Firstly the developer failed to use strtolower() when comparing strings, and the use of characters such as `%09` will also bypass the filter.	`Reflective XSS`	48
33	Our mistake: We did not intentionally leave the code to change emails if the correct values were set, however it created interesting results because most discovered this but missed bug ID `20` and `21` and whilst it was not possible to modify via integer, if the ID was known it would still work.	`Application/Business Logic`	44
34	This endpoint calls filesize() on the path provided in the 'proof' param with no filtering or sanitisation. By adding the phar:// stream handler to the path, an attacker can force a previously uploaded file to be sent through deserialisation. Coupled with the fact that a gadget-chain vulnerable version of monolog is being used, this allows for RCE.	`Deserialization`	31
35	A cronjob is set to execute the file /app/firstblood/scheduler.php every minute under the root user. This file is writable by the firstblood php pool user (fb-exec). The [checkproof bug] can be combined with this to obtain root privileges.	`RCE`	20
36	It is possible to use the composer.json to aid with another vulnerability and gaining information/knowledge on versions used.	`Information leak/disclosure`	28
37	The endpoint /vaccination-manager/api/vax-proof-list.php leaks PII without any authentication. The intended solution was to find it via swagger-ui at /vaccination-manager/api.php	`Information leak/disclosure`	24
38	Unintended/not working correctly: On first start, if a doctor account doesn't have an active session (no logins), then it is possible to achieve account takeover by providing a blank drps= cookie in a request to /drpanel/. As this is an isolated/edge case it won't count towards a unique finding.	`Application/Business Logic`	4
39	Our mistake: The parameter "goto" on login.php should of been "fixed" when redirecting to prevent XSS but due to an oversight from Sean and Karl, the new code did not make it into production. This has since updated since the event ended and you're recommended to re-try. It's related to bug `ID 26` because the idea was developers fixed this one (when redirecting) but forgot the other reflection.	`Reflective XSS`	26
40	The endpoint qp.php use to respond to GET requests and it should only allow administrators to query for patient information however the developers only fixed the bug partially and it still allowed for doctors to query for patient information. query.php is related to this file and in v1 allowed for Doctors and admins, but query.php was fixed completely whereas qp.php was not.	`Application/Business Logic`	38
41	Not fully working: Whilst it isn't possible to achieve Stored XSS without having access to the database (from SQL or RCE), when an appointment is "missed" with the "state=1", the date of birth is not protected from XSS. We ran out of time to finish building appointment handling so it doesn't count towards unique finds, but this was an intended feature we planned to build so it was interesting to see someone discovered it!	`Stored XSS`	1
42	The endpoint /api/checkproof.php can be used to check if an arbitrary file path exists on the server. There is no real impact from this and it's not something we intentionally added as an issue so this won't count towards a unique finding.	`Information leak/disclosure`	9
43	The session cookie is not invalidated in the database and thus old session tokens are still valid until a new login is made and a new session token is set.	`Application/Business Logic`	9
44	Whilst there's no security impact, it is possible to manage a cancelled appointment from visiting manageappointment.php with a valid appointmentID. When attempting to view a cancelled appointment view qa.php it will not respond, but manageappointment.php fails to do the checks.	`Application/Business Logic`	5

Researcher	'FirstBlood' Bugs	Respect	Hacking Time
iamvictorteh Level 6	19 — 0 disclosed	0	`2 days, 23 hours, 43 minutes and 14 seconds`
holybugx Level 5	19 — 14 disclosed	350	`2 days, 23 hours, 42 minutes and 39 seconds`
panya Level 7	19 — 20 disclosed	160	`1 days, 7 hours, 31 minutes and 52 seconds`
mrrootsec Level 2	18 — 17 disclosed	200	`3 days, 15 hours, 4 minutes and 24 seconds`
xnl-h4ck3r Level 4	18 — 16 disclosed	30	`2 days, 3 hours, 47 minutes and 30 seconds`
eliee Level 7	17 — 4 disclosed	100	`1 days, 11 hours, 56 minutes and 21 seconds`
newrouge Level 3	17 — 20 disclosed	40	`2 days, 17 hours, 36 minutes and 7 seconds`
kinako Level 5	17 — 10 disclosed	80	`1 days, 21 hours, 0 minutes and 10 seconds`
0x1452 Level 3	17 — 15 disclosed	30	`1 days, 1 hours, 55 minutes and 38 seconds`
shreky Level 4	17 — 16 disclosed	280	`2 days, 13 hours, 6 minutes and 54 seconds`
isitbug Level 3	17 — 0 disclosed	0	`1 days, 12 hours, 14 minutes and 54 seconds`
buraaq Level 2	17 — 6 disclosed	40	`2 days, 3 hours, 46 minutes and 12 seconds`
0xconft Level 5	16 — 5 disclosed	0	`1 days, 12 hours, 7 minutes and 48 seconds`
shivam18u Level 3	15 — 12 disclosed	10	`1 days, 0 hours, 15 minutes and 25 seconds`
vermsec Level 4	15 — 0 disclosed	0	`0 days, 6 hours, 14 minutes and 3 seconds`
netmous3 Level 4	15 — 1 disclosed	20	`3 days, 22 hours, 19 minutes and 11 seconds`
vigilante Level 4	15 — 13 disclosed	0	`3 days, 8 hours, 26 minutes and 13 seconds`
vishal Level 2	14 — 18 disclosed	50	`2 days, 7 hours, 54 minutes and 44 seconds`
0xblackbird Level 5	14 — 13 disclosed	110	`1 days, 12 hours, 50 minutes and 36 seconds`
gh0st10 Level 6	12 — 0 disclosed	0	`1 days, 8 hours, 46 minutes and 54 seconds`
thebinarybot Level 2	12 — 0 disclosed	0	`0 days, 15 hours, 37 minutes and 0 seconds`
amec0e Level 3	12 — 10 disclosed	10	`2 days, 16 hours, 48 minutes and 26 seconds`
twsec Level 2	12 — 15 disclosed	0	`4 days, 3 hours, 23 minutes and 30 seconds`
r0x61tremy Level 3	11 — 2 disclosed	50	`0 days, 15 hours, 25 minutes and 34 seconds`
sumyth Level 2	11 — 10 disclosed	10	`0 days, 23 hours, 43 minutes and 34 seconds`
serizao Level 2	10 — 0 disclosed	0	`0 days, 8 hours, 45 minutes and 58 seconds`
jomar Level 4	10 — 0 disclosed	0	`0 days, 8 hours, 20 minutes and 51 seconds`
stfn Level 3	9 — 0 disclosed	0	`1 days, 10 hours, 10 minutes and 40 seconds`
yashamin Level 2	9 — 1 disclosed	60	`0 days, 17 hours, 7 minutes and 58 seconds`
ibruteforce Level 4	9 — 0 disclosed	0	`0 days, 9 hours, 10 minutes and 30 seconds`
c3phas Level 4	9 — 3 disclosed	50	`2 days, 3 hours, 49 minutes and 16 seconds`
neolex Level 2	9 — 10 disclosed	0	`0 days, 8 hours, 52 minutes and 38 seconds`
th4nu0x0 Level 2	9 — 7 disclosed	0	`1 days, 1 hours, 49 minutes and 0 seconds`
natsu19 Level 3	8 — 0 disclosed	0	`0 days, 9 hours, 46 minutes and 26 seconds`
axe Level 4	8 — 10 disclosed	0	`3 days, 12 hours, 52 minutes and 12 seconds`
luisk2 Level 3	8 — 0 disclosed	0	`1 days, 3 hours, 56 minutes and 4 seconds`
sehno Level 3	7 — 0 disclosed	0	`0 days, 17 hours, 43 minutes and 5 seconds`
d20s84 Level 3	7 — 7 disclosed	10	`1 days, 5 hours, 35 minutes and 15 seconds`
n1ghtmar3 Level 2	7 — 0 disclosed	0	`1 days, 13 hours, 57 minutes and 21 seconds`
dravee Level 4	7 — 0 disclosed	0	`0 days, 22 hours, 23 minutes and 37 seconds`
yougina Level 3	7 — 0 disclosed	0	`1 days, 14 hours, 6 minutes and 48 seconds`
sumzer0 Level 2	7 — 1 disclosed	10	`1 days, 15 hours, 8 minutes and 23 seconds`
bobbylin Level 4	7 — 0 disclosed	0	`0 days, 0 hours, 0 minutes and 0 seconds`
zeeshan1337 Level 2	7 — 0 disclosed	0	`1 days, 3 hours, 57 minutes and 16 seconds`
rephlexsion Level 3	7 — 0 disclosed	0	`2 days, 4 hours, 26 minutes and 7 seconds`
0xirfan Level 5	6 — 4 disclosed	0	`0 days, 19 hours, 13 minutes and 24 seconds`
thecast Level 3	6 — 1 disclosed	20	`1 days, 2 hours, 17 minutes and 28 seconds`
gratitude Level 3	5 — 0 disclosed	0	`0 days, 6 hours, 32 minutes and 50 seconds`
mava Level 2	4 — 0 disclosed	0	`0 days, 0 hours, 16 minutes and 56 seconds`
pichik Level 4	3 — 0 disclosed	0	`0 days, 15 hours, 21 minutes and 42 seconds`
johandu97 Level 4	3 — 3 disclosed	0	`1 days, 11 hours, 10 minutes and 26 seconds`
predator97x Level 2	3 — 0 disclosed	0	`0 days, 1 hours, 24 minutes and 30 seconds`
0xsaltyhash Level 3	3 — 3 disclosed	0	`0 days, 12 hours, 0 minutes and 57 seconds`
th33phoenix Level 4	2 — 2 disclosed	0	`0 days, 19 hours, 5 minutes and 48 seconds`
jonlaing Level 2	2 — 0 disclosed	0	`0 days, 9 hours, 9 minutes and 25 seconds`
captboykin Level 2	2 — 0 disclosed	0	`0 days, 17 hours, 40 minutes and 46 seconds`
tmaxxer Level 2	2 — 0 disclosed	0	`0 days, 0 hours, 6 minutes and 8 seconds`
agentmellow Level 3	2 — 0 disclosed	0	`1 days, 6 hours, 21 minutes and 10 seconds`
rahat Level 2	1 — 0 disclosed	0	`0 days, 4 hours, 19 minutes and 37 seconds`
bowen229 Level 2	1 — 0 disclosed	0	`0 days, 5 hours, 9 minutes and 39 seconds`
iffu Level 5	1 — 0 disclosed	0	`0 days, 2 hours, 0 minutes and 29 seconds`
iambilaal Level 3	1 — 0 disclosed	0	`0 days, 0 hours, 28 minutes and 27 seconds`
liammcknight Level 2	1 — 0 disclosed	0	`0 days, 6 hours, 30 minutes and 0 seconds`
asdcxsd Level 2	1 — 0 disclosed	0	`0 days, 1 hours, 31 minutes and 55 seconds`

BugBountyHunter

FirstBlood Scope & Policy

Hacker Leaderboard

Disclosed Reports