twsec

Rank #248 — Level 2



29
unique bugs discovered
80 hours, 43 minutes and 32 seconds active hacking time

31
reports accepted
97 Accuracy
Vulnerability Types Found

Bug Submissions & total bug count

Hackevent (FirstBlood) Activity

Report Title Event ID Severity Vulnerability Type
a Doctor can cancel patient's appointments FirstBlood v1 High Insecure direct object reference
register as non admin doctor FirstBlood v1 High Auth issues
a non admin doctor can still view patient information using the api FirstBlood v1 High Application/Business Logic
Admin access is still possible FirstBlood v2 Informative
login as Admin FirstBlood v2 CRITICAL Application/Business Logic
enumerate usernames FirstBlood v2 Low Application/Business Logic
a normal user can change the message in an appointment of another user FirstBlood v2 Medium Insecure direct object reference
patient can change his email when he's not supposed to FirstBlood v2 Medium Application/Business Logic
register a doctor FirstBlood v2 Medium Auth issues
XSS in vaccine portal FirstBlood v2 High Stored XSS
finding and logging into the vaccination portal FirstBlood v2 CRITICAL RCE
Privilege escalation when having root FirstBlood v2 CRITICAL RCE
SQL Injection in vaccination manager login FirstBlood v2 CRITICAL SQL Injection
vaccination manager doesnt destroy the cookie on logout FirstBlood v2 Low Application/Business Logic
a non admin doctor can search for patients FirstBlood v2 Medium Application/Business Logic
stored XSS in manageappointment.php FirstBlood v2 High Stored XSS
stored XSS in cancelled appointment FirstBlood v2 High Stored XSS
[COLLAB] RCE using insecure deserialization FirstBlood v2 CRITICAL Deserialization
PII data leak FirstBlood v3 High Information leak/disclosure
Info Leak on api/ambulances.php leads to IDOR on manageappointment FirstBlood v3 High Information leak/disclosure