BugBountyHunter

Hi,

Please find a brief description of the vulnerability below,

Summary

It is possible to register as doctor on firstblood.com by making use of invite code 'test'. This allows an attacker to register a doctor account on the portal and access further functionalities.

Steps to Reproduce:

1. Visit the vulnerable endpoint. Add the required username in 'username' field and provide the invite code as 'test' and submit the form.

2. Observe that we are provided with a new set of credentials proving that the registration was successful.

3. Use the newly provided credentials to login. We are successfully able to login at the portal.

Impact

Bypassing the invitation code by using 'test' can allow an attacker to create arbitrary accounts which can be used to impersonate as doctor and view sensitive information with regards to patients.