[COLLAB] Able to modify email post booking an appointment

FirstBlood-#985 — [COLLAB] Able to modify email post booking an appointment
This issue was discovered on FirstBlood v2

This report has been reviewed and accepted as a valid vulnerability on FirstBlood!

On 2021-10-26, amec0e Level 3 reported:


        Hello,
It is not intended for a user to change details of an appointment except message. However this vulnerability allows user to change his/her email.
Steps to Reproduce :

Visit /book-appointment.php and create an appointment



Visit /yourappointments.php and view your appointment inorder to modify later.



It's not possible to directly modify the email, however using burp we can intercept the request that we use to modify the message and add email parameter to it with a new value. This overrides the previous mail address and updates accordingly.


Impact :
User is not supposed to change the email address post booking an appointment. This vulnerability bypasses that logic.
Collaboration :
In collaboration with amec0e

This report has been publicly disclosed for everyone to view

P3 Medium

Endpoint: /api/ma.php

Parameter: email

Payload: [email protected]

FirstBlood ID: 33
Vulnerability Type: Application/Business Logic

Our mistake: We did not intentionally leave the code to change emails if the correct values were set, however it created interesting results because most discovered this but missed bug ID 20 and 21 and whilst it was not possible to modify via integer, if the ID was known it would still work.

BugBountyHunter