BugBountyHunter

Hello Zseano,Hope you are doing well..Say hi to Sebastian :)

Description:

Firstblood application is asking invite code when registering as a doctor. Invite code is being leaked in FirstBlood Scope & Policy .Using the leaked invite code anyone can register as doctor role.

Steps to Reproduce the Issue :

1. Navigate to the FirstbloodV2 Program Scope and Policy

2. If you read carefully at the Credentials available paragraph test is being highlighted in the policy

   

3. Then go to the https://719f36d6abd3-mrrootsec.a.firstbloodhackers.com/register.php

4. Provide any username and invite code from policy page and register. You can see the application validates the invite code and provide the access credentials

   

Impact :

1. As an attacker using this leaked invite code,attacker can register as doctor role and can impersonate the user by doing malicious activities.

Remediaton / Fix :

1. Invite code & Tokens should be restricted to the public users.

Thanks and Regards

MOHAMMAD SAQLAIN