Invite Code leaking on Reddit

FirstBlood-#25 — Invite Code leaking on Reddit
This issue was discovered on FirstBlood v1

This report has been reviewed and accepted as a valid vulnerability on FirstBlood!

On 2021-05-09, mava Level 2 reported:


Hi zseano,

I found an Info Leak on Reddit.

https://www.reddit.com/r/BugBountyHunter/comments/n4xzw1/firstbloodhackerscom_doctor_registration/
Impact
This Reddit leaks the invite code F16CA47250E445888824A9E63AE445CE which thereby allows anybody to signup as a doctor.

This could allow anybody to read sensitive information.
PoC

Goto http://firstbloodhackers.com:49331/register.php
Enter a username and F16CA47250E445888824A9E63AE445CE.
You are signed in!

Fix
Invalidate the invite Code. 
Best regards,

Max

This report has been publicly disclosed for everyone to view

P2 High

Endpoint: reddit

Parameter: Invite Code

Payload: F16CA47250E445888824A9E63AE445CE

FirstBlood ID: 15
Vulnerability Type: Auth issues

A doctors invite code is leaked on the internet which if used grants anyone access to the doctor portal. The invite code should expire after use.

Report Feedback

@zseano

Creator & Administrator

Nice find mava :)