FirstBlood-#1672 — Able to delete an ambulance from an appointment
This issue was discovered on FirstBlood v3
On 2022-12-13, didsec Level 5 reported:
Hi there
I found it is possible to delete a ambulance from an appointment via a api call to /api/manageambulances.php
To reproduce :
- Visit
firstbloodhackers.com/book-appointment.php
and fill in the information required to make an appointment
- Click
Book Appointment
and intercept the request
- Add
&ambulance=1
to the data and forward the request

- Take note of the created appointment ID

- Visit
firstbloodhackers.com/api/ambulances.php?select={appointment ID}
and take note of the ambId

- Visit
firstbloodhackers.com/api/manageambulances.php?ambId={ambId}
and intercept the request
- Change the request to a
DELETE
request and forward the request

The ambulance has now been deleted from the appointment.
We can check this by visiting firstbloodhackers.com/ambulance.php?apptId={appointment ID}
or by making a call to /api/ambulances.php

P2 High
FirstBlood ID: 77
Vulnerability Type: Access_control
Sending an unauthenticated DELETE request to /api/manageambulances.php will cause that ambulance to be deleted
Creator & Administrator
Congratulations you were third to discover this!