FirstBlood-#838 — Regular accounts can override access to patient information
This issue was discovered on FirstBlood v2

On 2021-10-29, axe Level 4 reported:

Summary

  1. General account query, query failed -> Admin account query, query succeeded and its endpoint and parameters recorded -> Use general account to access the endpoint and parameters -> query succeeded!

Steps

  1. Login to your jam account and check your patient information

    1. Query failed, insufficient privileges

  2. Combined with the submitted report (#id=837), login to the administrator account to query and use BURP to capture the package

    1. Admin user query successful!!!

  3. Log out of the Admin user, log in to the regular account Jam again, visit the /drpanel/drapi/qp.php endpoint, and query the Sean patient

    1. Regular users query success!!!

Impact

  1. Ordinary accounts can override access to patient information(IDOR)

P3 Medium

Endpoint: /drpanel/drapi/qp.php

Parameter: name

Payload: Sean

FirstBlood ID: 40
Vulnerability Type: Application/Business Logic

The endpoint qp.php use to respond to GET requests and it should only allow administrators to query for patient information however the developers only fixed the bug partially and it still allowed for doctors to query for patient information. query.php is related to this file and in v1 allowed for Doctors and admins, but query.php was fixed completely whereas qp.php was not.