FirstBlood-#488 — Able to change the email id in any appointment
This issue was discovered on FirstBlood v2

On 2021-10-25, shivam18u Level 3 reported:

Hi Sean,

I noticed that we can update the email field of any appointment if we have the doctorAuthed cookie present in the request.

Steps to reproduce:

1) Go to manage appointment page and enter the appointment id.

2) Start burp intercept and click on Modify Appointment in browser.

3) Intercept the request and add a parameter in the request body email=new_email.

4) Forward the request.

You will get a success message. You can confirm by revisiting the modify appointment page.

P3 Medium

Endpoint: /api/ma.php

Parameter: email

Payload: email address

FirstBlood ID: 33
Vulnerability Type: Application/Business Logic

Our mistake: We did not intentionally leave the code to change emails if the correct values were set, however it created interesting results because most discovered this but missed bug ID 20 and 21 and whilst it was not possible to modify via integer, if the ID was known it would still work.