FirstBlood-#427 — Reflective XSS at /login.php
This issue was discovered on FirstBlood v2
On 2021-10-25, d20s84 Level 3 reported:
Hi Sean! Hope you are doing well!! I found a reflective xss on the doctor login page.
- Look into the source Code. There is a hidden parameter named goto .
- Craft the URL with goto as a query string.
- Submit the above provided payload and hit Enter. 4.Boom! The payload triggers!!
Cross site scripting can lead to various devastating attacks such as stealing cookie for user impersonation and many more.
Image below shows the triggered payload. **Image below shows how the website looks after the ok button to the alert box is pressed.
FirstBlood ID: 26
Vulnerability Type: Reflective XSS
The developers thought they had fixed ?goto= when reflected in an input tag on login.php from a similar bug (
ID 39), but because this endpoint uses legacy code their changes were not applied here and thus the XSS was forgotten.