FirstBlood-#551 — Enumerate usernames
This issue was discovered on FirstBlood v2
On 2021-10-26, twsec Level 2 reported:
Getting started
Learn about vulnerability types 
Getting started in bug bounties 
Test your knowledge
Free Web Application Challenges
Guides for your hunts 
ZSeano's Methodology
Effective Note Taking for bug bounties
Useful Resources 
Disclosed HackerOne Reports 
Our community
Endorsed Members
Hackevents 
Member Articles
as mentioned before the editpassword.php function can be used by any non authenticated user to enumerate usernames and change their password at the same time thus taking over their account.
P4 Low
Endpoint: /drpanel/drapi/editpassword.php
This report contains multiple vulnerabilities:
FirstBlood ID: 27
Vulnerability Type: Application/Business Logic
It is possible to edit the admins password (dradmin) from /drapi/editpassword as it's only looking for the username. Usernames can be enumerated when logging in as trying 'drAdmin' results in a different error. The username can also be found from FirstBlood v1.
FirstBlood ID: 28
Vulnerability Type: Auth issues
The endpoint /drapi/editpassword can actually be accessed unauthenticated.
Report Feedback
Creator & Administrator
Hi twsec, we don't have a unique bug for enumerating usernames from this endpoint so i'm going to assign ID 27 as the description mentions about user enumeration.