E-Arogya

Sensitive Data Passed Through URL Parameters
observation : Repeated
CWE : CWE-598
Description :
The web application uses the HTTP GET method to process a request and includes
sensitive information in the query string of that request.
Affected Path(s) :
https://his-healthidservice.satragroup.in/abdm/isAvailable/customHealthId/srinuks.1 *-Applicable to entire
application
Impact :
This allows attackers to obtain sensitive data such as usernames, passwords, tokens
(authX), database details, and any other potentially sensitive data. Simply using HTTPS
does not resolve this vulnerability.
Evidence/Proof Of Concept :
Step 1: ABHA Username Passed Through URL as shown in below screenshot.

Step 2: Functionality issue

Recommendation :
When sensitive information is sent, use the POST method (e.g. registration form, login
form, etc.).