A non admin doctor can search for patients

FirstBlood-#828 — A non admin doctor can search for patients
This issue was discovered on FirstBlood v2

This report has been reviewed and accepted as a valid vulnerability on FirstBlood!

On 2021-10-29, twsec Level 2 reported:


        when registering as a new doctor you have limited accessibility, for example you cannot search or view patient information from the panel, however you have several endpoints we can use to access data, 
reproduction steps: 

login using a non admin doctor and check that you have no rights to view patients data:

notice the cookie value



if i use the api i can view those data


if we leave the username empty the api will show us all data available.

This report has been publicly disclosed for everyone to view

P3 Medium

Endpoint: /drpanel/drapi/qp.php

Parameter: qp.php

Payload: enter a name in the body

FirstBlood ID: 40
Vulnerability Type: Application/Business Logic

The endpoint qp.php use to respond to GET requests and it should only allow administrators to query for patient information however the developers only fixed the bug partially and it still allowed for doctors to query for patient information. query.php is related to this file and in v1 allowed for Doctors and admins, but query.php was fixed completely whereas qp.php was not.

BugBountyHunter