Patient data can be accessed by Non Admin doctors

FirstBlood-#804 — Patient data can be accessed by Non Admin doctors
This issue was discovered on FirstBlood v2

This report has been reviewed and accepted as a valid vulnerability on FirstBlood!

On 2021-10-28, shivam18u Level 3 reported:


        Hi Sean, 
I found that the patient data can be accessed by a non admin doctor by sending a POST request to /drpanel/drapi/qp.php with parameter name. 
The header Content-Type: application/x-www-form-urlencoded must be present in the request. 

Non Admin doctor should not be able to fetch this data. 
Have a nice day!

This report has been publicly disclosed for everyone to view

P3 Medium

Endpoint: /drpanel/drapi/qp.php

Parameter: name

Payload: .

FirstBlood ID: 40
Vulnerability Type: Application/Business Logic

The endpoint qp.php use to respond to GET requests and it should only allow administrators to query for patient information however the developers only fixed the bug partially and it still allowed for doctors to query for patient information. query.php is related to this file and in v1 allowed for Doctors and admins, but query.php was fixed completely whereas qp.php was not.

BugBountyHunter