BugBountyHunter

Hello Zseano, Hope you are doing well...

Description :

As per the application logic new registered doctor not able to search or view the patient details.It will show You are not authorised to view this. Consult your medical administrator. But through API endpoint we can get the patient data by bypassing frontend restrictions.

Steps to Reproduce the Issue :

1. Navigate to https://719f36d6abd3-mrrootsec.a.firstbloodhackers.com/register.php
2. Create a new user and Login with the provided credentials
3. Go to Search Patient,Enter any search term -> click on Search, application gives an error As your account is new you are unable to search for patients.

4. If we make POST based request containing name parameter in body to this endpoint https://719f36d6abd3-mrrootsec.a.firstbloodhackers.com/drpanel/drapi/qp.php,we can get the patient details bypassing the front-end restrictions.

   

Impact :

1. As an attacker using this Vulnerability PII information can be obtained

Remediation / Fix :

1. Add Proper Access control to the API Endpoints
2. Handle Access Controls At Server-Side
3. Enable RBAC (Role Based Access Controls)

References :

1. https://crashtest-security.com/broken-access-control-prevention/
2. https://www.prplbx.com/resources/blog/broken-access-control/

Thanks and Regards MOHAMMAD SAQLAIN