FirstBlood-#874 — New doctors can easily get access to patients private data
This issue was discovered on FirstBlood v2

On 2021-10-29, 0xblackbird Level 5 reported:

Hi! I can see that the previously reported issue is still not patched. New doctors are still able to view patients private data while they actually shouldn't be able to do so.

Steps to reproduce:

  • First of all, make sure you login as a doctor that registered recently, you can use the test credentials: testdoctor:test

  • Next, visit the vulnerable endpoint, which is /drpanel/drapi/qp.php, and intercept this request using a proxy interceptor. Once intercepted, do the following to the request:
    • Change the Request Method to POST: GET >> POST
    • Add the Content Type header: Content-Type: application/x-www-form-urlencoded
    • Append a POST parameter in the body of the request: name=
    • Forward the request: Ctrl + F

  • Go back to your webbrowser and you'll see that we can view the private data of each registered patient.

Thanks!

Kind regards,
0xblackbird

P3 Medium

Endpoint: /drpanel/drapi/qp.php

Parameter: name

Payload: N/A

FirstBlood ID: 40
Vulnerability Type: Application/Business Logic

The endpoint qp.php use to respond to GET requests and it should only allow administrators to query for patient information however the developers only fixed the bug partially and it still allowed for doctors to query for patient information. query.php is related to this file and in v1 allowed for Doctors and admins, but query.php was fixed completely whereas qp.php was not.