FirstBlood-#653 — Account takeover by overwriting user's password
This issue was discovered on FirstBlood v2
On 2021-10-27, neolex Level 2 reported:
Getting started
Learn about vulnerability types 
Getting started in bug bounties 
Test your knowledge
Free Web Application Challenges
BugBountyHunter Membership
Guides for your hunts 
ZSeano's Methodology
Effective Note Taking for bug bounties
Useful Resources 
Disclosed HackerOne Reports 
Our community
Endorsed Members
Hackevents 
Member Articles
Description
The register.php endpoint is insecure.
An attacker can overwrite any user's password via register function.
If you use a existing username when registering you will have the error This invite code is not valid.
But if you intercept the query and append %00 you will have another password set to the victim user.
Step to reproduce
- Go to https://6899078990e9-neolex.a.firstbloodhackers.com/register.php
- Intercept the request of the form with the user's username you want to takeover and the
test invite code
- append %00 to the username
- The victim's password will be changed and displayed
Impact
The impact is account takeover of any admin or doctor's account
P3 Medium
Endpoint: /register.php
Parameter: username
Payload: neolex%00
FirstBlood ID: 24
Vulnerability Type: Auth issues
The old invite code was deleted but when testing FirstBlood v2 the developers accidentally left the test code working.