Medium
Broken Access Control / IDOR
Harborview Clinic patient messaging IDOR
A hospital patient portal. An attachment download trusts a client-supplied patient id.
PentestingHere Academy
Official Academy lab
- Attempts
- 17
- Solves
- 17
- Published
- 25 Aug 2026
Scenario
Harborview Clinic's patient portal lets patients message their care team and attach files. Attachments download from /attachment.php?patient_id=&file_id=.
Goal
Download the lab-results attachment belonging to another patient, margaret_h. The flag is the internal reference code printed inside that file.