FirstBlood-#335XSS bypass on cancel report
This issue was discovered on FirstBlood v2.0.0 (issues patched)



On 2021-10-25, buraaq Level 2 reported:

Hello zseano,

Summary

I have found a bypass for stored xss on /api/ma.php.

Payload : "><img/src="x"/tabinde/onerror="confirm`1`">

POC

Impact

We can take over admin account/session as httponly is set to false. Run JS code on admin panel

i will reedit this report and more details soon

Kind regards. buraaqsec

P2 High

Endpoint: /api/ma.php

Parameter: message

Payload: "><img/src="x"/tabinde/onerror="confirm`1`">


FirstBlood ID: 22
Vulnerability Type: Stored XSS

Whilst an attempt was made to fix the stored XSS vulnerability in managing an appointment, it actually introduced new issues such as when creating and editing and not just when cancelling the appointment. Making use of htmlentities() and relying on .value() in javascript to encode certain characters does not prevent XSS overall. The 'fix' to this issue also results in it being vulnerable to admins on cancelled appointments as well.