FirstBlood-#336 — [COLLAB with isitbug] Reflected XSS via message on cancelled appointment
This issue was discovered on FirstBlood v2

On 2021-10-25, shreky Level 5 reported:

Summary

A Stored XSS is possible via the message on a cancelled appointment,from the previous bug that existed here,the message is now contained in a javascript variable,which can be easily broken out of using ';alert();//.

Steps to reproduce

  1. Make an appointment(keep note of the id and the endpoint /manageappointment.php?success&aptid={id}
  2. Go to Manage appointment and click on Modify appointment and add the malicious comment to the request,it should look like so act=cancel&id=ebf03fb1-a073-438c-9c22-8524338dc7d6&message=';alert();//
  3. Go back to /manageappointment.php?success&aptid=ebf03fb1-a073-438c-9c22-8524338dc7d6 and the XSS will execute

Impact

Stored XSS affecting everyone that visits /manageappointment.php?success&aptid={id}.

PoC -->

Our payload in the source code -->

P2 High

Endpoint: /manageappointment.php

Parameter: message

Payload: ';alert();//

FirstBlood ID: 22
Vulnerability Type: Stored XSS

Whilst an attempt was made to fix the stored XSS vulnerability in managing an appointment, it actually introduced new issues such as when creating and editing and not just when cancelling the appointment. Making use of htmlentities() and relying on .value() in javascript to encode certain characters does not prevent XSS overall. The 'fix' to this issue also results in it being vulnerable to admins on cancelled appointments as well.