Information disclosure

FirstBlood-#1632 — Information disclosure
This issue was discovered on FirstBlood v3

This report has been reviewed and accepted as a valid vulnerability on FirstBlood!

On 2022-12-12, srb1mal Level 4 reported:


        Hello sean,
Summary -
I found an  info disclosure on /api/locations.php endpoint with location parameter.
Steps to reproduce -

Visit https://057253f90d39-srb1mal.a.firstbloodhackers.com/api/locations.php?location=chicago & it says it leaked some kind of private data which i don't know where to use.

POC - 

Thanks & Regards,
srb1mal

This report has been publicly disclosed for everyone to view

P2 High

Endpoint: /api/locations.php

Parameter: location

Payload: chicago

FirstBlood ID: 62
Vulnerability Type: Access_control

The endpoint /api/locations?location= leaks the Seattle and Chicago address despite them being listed as PRIVATE on FirstBloodv3

BugBountyHunter