BugBountyHunter

Description:

A new doctor registration invitation code was leaked to the public via redit forum. Further the new doctor registration on Firstbloodhacker.com did not employee two factor verification and invitation code leaked to the public was not expiring. Also the web application not employing single use on invitation code. These issues let attacker to create any number of doctor logins and access the patients critical information.

Steps To Reproduce:

1. Copy the invitation code from redit forum.
2. Visit the new doctor registration portal and enter the invitation code with any attacker preferred name as the username.
3. Login to the internal doctor's portal with the new user and supplied password via #2.

Impact:

Critical information including patients PII data could leaked to the public and the Firstbloodhacker may in violation to the GDPR regulation.