FirstBlood-#164 — Can know who are attending an HackerBack event
This issue was discovered on FirstBlood v1
On 2021-05-11, codersanjay Level 3 reported:
Getting started
Learn about vulnerability types 
Getting started in bug bounties 
Test your knowledge
Free Web Application Challenges
Guides for your hunts 
ZSeano's Methodology
Effective Note Taking for bug bounties
Useful Resources 
Disclosed HackerOne Reports 
Our community
Endorsed Members
Hackevents 
Member Articles
The following endpoint is present in source code.
It seems like it will show status of attendees who are attending an event.
But after sending POST/GET request to this end point, it was throwing 200OK but no content.
I then realised, may be a header should be added which I saw in the source code drpanel.
Sent a modified request.
It was leaking info of who are attending the event.
I also see the ID of old event.Tried sending same request with old event id.
Impact
PII info leak.
P1 CRITICAL
Endpoint: /attendees/event.php?q=560720
Parameter: x-site-req
Payload: nil
FirstBlood ID: 13
Vulnerability Type: Information leak/disclosure
/attendees/event can be seen on the HackerBack.html page but has a blank response. Upon further inspection and from making use of the web app, you will notice you can add certain headers in order to interact with this endpoint. An old event ID leaks PII information about attendees.