BugBountyHunter

I have discovered a stored XSS vulnerability affecting the /api/ambulances.php endpoint via the parameters fname and lname when booking an appointment.

Payload

"><svg/onload=alert(document.domain)>

To reproduce:

1. Visit firstbloodhackers.com/book-appointment.php and fill in the information required to make an appointment
2. Click Book Appointment and intercept the request
3. Replace the fname or the lname with the payload and add &ambulance=1 to the data
4. Take note of the created appointment ID
5. Visit firstbloodhackers.com/api/ambulances.php?select={ID} and the xss will execute

Impact:

1. The attacker could steal a user's cookies.
2. The attacker can steal data from whoever views the page.
3. Users can execute arbitrary JavaScript code in the context of other users.