FirstBlood-#985 — [COLLAB] Able to modify email post booking an appointment
This issue was discovered on FirstBlood v2

On 2021-10-26, amec0e Level 3 reported:

Hello,

It is not intended for a user to change details of an appointment except message. However this vulnerability allows user to change his/her email.

Steps to Reproduce :

  1. Visit /book-appointment.php and create an appointment

  1. Visit /yourappointments.php and view your appointment inorder to modify later.

  1. It's not possible to directly modify the email, however using burp we can intercept the request that we use to modify the message and add email parameter to it with a new value. This overrides the previous mail address and updates accordingly.

Impact :

User is not supposed to change the email address post booking an appointment. This vulnerability bypasses that logic.

Collaboration :

In collaboration with amec0e

P3 Medium

Endpoint: /api/ma.php

Parameter: email

Payload: [email protected]

FirstBlood ID: 33
Vulnerability Type: Application/Business Logic

Our mistake: We did not intentionally leave the code to change emails if the correct values were set, however it created interesting results because most discovered this but missed bug ID 20 and 21 and whilst it was not possible to modify via integer, if the ID was known it would still work.