FirstBlood-#678Stored XSS on vaccination-manager/portal.php
This issue was discovered on FirstBlood v2

On 2021-10-27, shivam18u Level 3 reported:

Hi Sean,

I found a stored XSS on /vaccination-manager/portal.php

The data from User-Agent header is not sanitized properly.

When uploading the proof of appointment, intercept the request and edit the User-Agent header.

Submit the request.

Now login in the vaccination-manager portal to see the XSS triggered.

Have a nice day!

P2 High

Endpoint: vaccination-manager/portal.php

Parameter: User-Agent

Payload: </td><script>alert(document.domain)</script>

FirstBlood ID: 29
Vulnerability Type: Stored XSS

When uploading a vaccine proof it is possible to achieve stored XSS against admins set via the user agent. As this value typically can't be user controlled the developers did not think it was 'worth' preventing against XSS.