FirstBlood-#650 — Stored XSS when cancelling an appointement triggered in doctor panel
This issue was discovered on FirstBlood v2
On 2021-10-27, neolex Level 2 reported:
Getting started
Learn about vulnerability types 
Getting started in bug bounties 
Test your knowledge
Free Web Application Challenges
Guides for your hunts 
ZSeano's Methodology
Effective Note Taking for bug bounties
Useful Resources 
Disclosed HackerOne Reports 
Our community
Endorsed Members
Hackevents 
Member Articles
Description
The is a stored XSS when cancelling an appointement triggered in doctor panel.
An attacker can add the parameter "message" when cancelling an appointement and this one is reflected without encoding on doctor panel
Step to reproduce
- Make an appointement here : https://6899078990e9-neolex.a.firstbloodhackers.com/book-appointment.php
- save the appointement ID
- Make a POST request to https://6899078990e9-neolex.a.firstbloodhackers.com/api/ma.php with the following parameter
act=cancel&id=325f745e-e68d-4cf2-bfae-b4dceee184c2&message="><svg onload=alert(document.cookie) >
with replacing the id for the one you saved.
Fix
You should html encode the following character : ><
Impact
An attacker can execute javascript inside doctor's browsing, meaning they can steal cookies without any user interaction
P2 High
Endpoint: /api/ma.php
Parameter: message
Payload: "><svg onload=alert(document.cookie) >
FirstBlood ID: 22
Vulnerability Type: Stored XSS
Whilst an attempt was made to fix the stored XSS vulnerability in managing an appointment, it actually introduced new issues such as when creating and editing and not just when cancelling the appointment. Making use of htmlentities() and relying on .value() in javascript to encode certain characters does not prevent XSS overall. The 'fix' to this issue also results in it being vulnerable to admins on cancelled appointments as well.