FirstBlood-#425 — Stored XSS in cancelled appointments message functionality
This issue was discovered on FirstBlood v2
On 2021-10-25, sumyth Level 2 reported:
Please find a brief description of the vulnerability below,
In firstblood.com, users having prior appointments are given an option to cancel it along with a message which then is shown to the doctor in doctor's panel. The message parameter is vulnerable to stored XSS.
Steps to reproduce:
Cancel a previously booked appointment and capture the request using burp.
In the captured request, modify the message parameter and add the payload as shown below and forward the request to server.
- Observe that the server responds with a 200 OK 'success' message. Login as drAdmin and check the cancelled appointments section. Observe that the payload is executed.
Stored XSS along with unprotected session cookies can allow an attacker to perform account takeover without any kind of user interaction.
FirstBlood ID: 22
Vulnerability Type: Stored XSS