We are getting close to releasing BugBountyHunter v2 which will introduce a brand new website, including member platforms, new features, challenges, guides, videos, and the long awaited zseano methodology v2. Right now, all of the content on this website is considered out-dated, however our members section continues to operate for members.
Stay tuned for updates coming soon!
FirstBlood-#678 — Stored XSS on vaccination-manager/portal.php
This issue was discovered on FirstBlood v2
On 2021-10-27, shivam18u Level 3 reported:
Getting started
Learn about vulnerability types 
Getting started in bug bounties 
Test your knowledge
Free Web Application Challenges
Guides for your hunts 
ZSeano's Methodology
Effective Note Taking for bug bounties
Useful Resources 
Disclosed HackerOne Reports 
Our community
Endorsed Members
Hackevents 
Member Articles
Hi Sean,
I found a stored XSS on /vaccination-manager/portal.php
The data from User-Agent header is not sanitized properly.
When uploading the proof of appointment, intercept the request and edit the User-Agent header.
Submit the request.
Now login in the vaccination-manager portal to see the XSS triggered.
Have a nice day!
P2 High
Endpoint: vaccination-manager/portal.php
Parameter: User-Agent
Payload: </td><script>alert(document.domain)</script>
FirstBlood ID: 29
Vulnerability Type: Stored XSS
When uploading a vaccine proof it is possible to achieve stored XSS against admins set via the user agent. As this value typically can't be user controlled the developers did not think it was 'worth' preventing against XSS.