FirstBlood-#148 — New Doctors can use the api to get patients data
This issue was discovered on FirstBlood v1

On 2021-05-10, 0xSaltyHash Level 3 reported:

Summary:

When you register a new doctor account and log in you get a message saying that new doctors can't access patient information.

But I can interact with the drapi endpoints without problems, if I know the appointment id I can query the api and get the patient info and the api request is shown in the page html.

But to be able to exploit this to the full extent you need to know the aptid somehow (you can bruteforce it).

also we can search for patients using the search api on this endpoint /drpanel/drapi/qp.php?name=s

Steps to reproduce:

  1. Go to /register and enter your username and invitecode.

  1. After that log in using the credential generated.
  2. Go to /drpanel/drapi/qp.php?name=s

P1 CRITICAL

Endpoint: /drpanel/drapi/qp.php

Parameter: name=

Payload: GET /drpanel/drapi/qp.php?name=s

FirstBlood ID: 11
Vulnerability Type: Application/Business Logic

Administrator endpoints can be accessed by non privileged doctor accounts which reveals sensitive patient information.