BugBountyHunter

I have discovered it is possible to edit the details of an assigned ambulance and that the drivers name is vulnerable to stored XSS

Payload

<img src=x onerror=alert(document.domain)>

To reproduce:

1. Visit firstbloodhackers.com/book-appointment.php and fill in the information required to make an appointment
2. Click Book Appointment and intercept the request
3. Add &ambulance=1 to the data and forward the request

4. Take note of the created appointment ID

5. Visit firstbloodhackers.com/api/ambulances.php?select={appointment ID} and take note of the ambId

6. Visit firstbloodhackers.com/api/manageambulances.php and intercept the request
7. Change the request to a PUT request
8. Add the following JSON to the data and forward the request

   {"driver": "<img src=x onerror=alert(document.domain)>","number": "077777777777",
   "ambId": "{ambId}"
   }

   

Xss will execute when visiting firstbloodhackers.com/ambulance.php?apptId={appointment ID}

Impact:

1. The attacker could steal a user's cookies.
2. The attacker can steal data from whoever views the page.
3. Users can execute arbitrary JavaScript code in the context of other users.