Another unauthorized location on the Registration Network allows you to modify others' information.

Another unauthorized location on the Registration Network allows you to modify others' information.

 

This is the management of the visitor.

You can modify the information of the contact.

Two main parameters, patient_id and user_id, will be passed when the patient information is saved.

Patient_id should be used to control the information of the visitor

User_id is user information. A user can add multiple medical contacts.

When saving, modify the patient_id parameter to modify the information of any user.

User 1:
 

User 2:
 

User 1's patient_id and user_id:
 

User 2's patient_id and user_id:
 

Modify the modifiable Information Section of user 1 and save the information and intercept it with Fiddler.
 

At this time, the user 1 Information is modified, but after refreshing, the original information is changed back.
 

User 2 Information, modified
 

 

Solution:

Permission Control