FirstBlood-#166 — PII Creditcard information leaking via Event
This issue was discovered on FirstBlood v1

On 2021-05-11, mava Level 2 reported:

Hi Sean, I found a vulnerability which leaks PII.

Summary

An attacker can craft a request which reveals a lot of PII data, including "last_4_cc" creditcard information.

PoC

  1. Visit /drpanel/drapi/sitesettings.php you will see some information like:
  2. This leaks the headers x-required: permittedand x-site-req: permitted.
  3. Add these to the /attendees/event.php?q=560720 endpoint to see some PII:
  4. From this information we can get the "old_eventID", if we fetch the same endpoint with this ID we get:
  5. This reveals who is attending the event and also show their creditcard information "last_4_cc".

Impact

Unauthenticated access to a lot of PII including Email, Creditcard Information, Phone number.
This could be used to impersonate a victim in e.g. a Sim-Swapping Social Engineering attack like it was done on Twitter last year.

Potential Fix

Implement better authentication for the /attendees/event.php endpoint and disable the /drpanel/drapi/sitesettings.php Endpoint completly.

Best regards,
Max

P1 CRITICAL

Endpoint: /attendees/event.php

Parameter: q=

Payload: 560700

FirstBlood ID: 13
Vulnerability Type: Information leak/disclosure

/attendees/event can be seen on the HackerBack.html page but has a blank response. Upon further inspection and from making use of the web app, you will notice you can add certain headers in order to interact with this endpoint. An old event ID leaks PII information about attendees.