User's vaacination data leak and with other info without needing to log into vaccine-manger portal

FirstBlood-#695 — User's vaacination data leak and with other info without needing to log into vaccine-manger portal
This issue was discovered on FirstBlood v2

This report has been reviewed and accepted as a valid vulnerability on FirstBlood!

On 2021-10-27, newrouge Level 3 reported:


Hey, i found that any user can can access all user's PII info and vaccine info, through unauthenticated endpoint /vaccination-manager/api/vax-proof-list.php.


After directory fuzzing on /vaccination-manager/ a file stands out, api.php.


Let's visit that url https://2c19d123df3d-newrouge.a.firstbloodhackers.com/vaccination-manager/api.php . we see this page.



We see that /vaccination-manager/api/vax-proof-list.php will return each record of vaccination.


let's visit that, https://2c19d123df3d-newrouge.a.firstbloodhackers.com/vaccination-manager/api/vax-proof-list.php .



Thank you
newrouge

This report has been publicly disclosed for everyone to view

P1 CRITICAL

Endpoint: /vaccination-manager/api/vax-proof-list.php

This report contains multiple vulnerabilities:

Info leak
Information leak/disclosure

FirstBlood ID: 37
Vulnerability Type: Information leak/disclosure

The endpoint /vaccination-manager/api/vax-proof-list.php leaks PII without any authentication. The intended solution was to find it via swagger-ui at /vaccination-manager/api.php

FirstBlood ID: 31
Vulnerability Type: Information leak/disclosure

The endpoint api.php can be found under the vaccination manage portal directory which allows for user interaction and results in PII leak on vax-proof-list.php

BugBountyHunter