E-Arogya

4- User Account Takeover
CWE : CWE-285
Description :
The software does not perform or incorrectly performs an authorization check when an
actor attempts to access a resource or perform an action.
Affected Path(s) :
https://earogya.satragroup.in/login *-Applicable to entire application
Impact :
An attacker could modify sensitive data, either by writing the data directly to a data
store that is not properly restricted, or by accessing insufficiently-protected, privileged
functionality to write the data.
Recommendation :
It is recommended to make sure that the access control mechanism is enforced correctly
at the server side on every page. Users should not be able to access any unauthorized
functionality or information by simply requesting direct access to that page.
Evidence/Proof Of Concept :
Step 1: Access the application and go to forgot password page.Enter valid user then capture
the request as shown in below screenshot.

Step 2: Change userid 316 to 317 then forword the requet.Observe the response Password
changed sucessfully with Modified user.