# User with no permissions can create, edit, delete favorite prescriptions /erx/

A staff member with zero permissions could still POST to /erx/favorites/ endpoints to create, edit, and delete a doctor's favorite prescriptions.

- Payout: hidden
- Severity: medium
- Program: drchrono
- Found by: yaworsk
- Disclosed: 2016-11-25
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/142101
- Library page: https://bugbountylibrary.com/r/h1%3A142101
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:medium tech:rest technique:source-review vuln:access-control vuln:auth-bypass

**Target:** /erx/favorites/ save_prescription and delete_prescription endpoints
**Root cause:** The favorites save/edit/delete endpoints enforce no permission check, so a staff account with no granted permissions can still mutate prescription favorites despite the /erx/ UI returning permission denied.
**Steps:**
1. Create a doctor's organization and a staff member with no permissions.
2. Log in as the no-permission staff member; visiting `https://1337test.drchrono.com/erx/` returns permission denied.
3. Create a favorite via `POST /erx/favorites/save_prescription/` with `data=` JSON body and valid CSRF token.
4. Edit via `POST /erx/favorites/save_prescription/64808/` with modified `data=` JSON.
5. Delete via `POST /erx/favorites/delete_prescription/` with body `id=64810`.
**How found:** Noticed the /erx/ page returned permission denied for a no-permission staff member, then tested the underlying favorites AJAX endpoints directly and found they still accepted the requests.
**Exploitation:** An authenticated low-privilege staff account replays the favorites POST requests with its own cookies and CSRF token to create, alter, or delete a doctor's favorite prescriptions; a tampered favorite (e.g. changed refills or note) could later be used by the doctor to prescribe to a patient.
**Insight:** When a UI page denies access, test the individual XHR/AJAX endpoints it would call directly — permission checks are often only on the page view, not the JSON/form action handlers.