FirstBlood-#678 — Stored XSS on vaccination-manager/portal.php
This issue was discovered on FirstBlood v2
On 2021-10-27, shivam18u Level 3 reported:
I found a stored XSS on
The data from
User-Agentheader is not sanitized properly.
When uploading the proof of appointment, intercept the request and edit the User-Agent header.
Submit the request.
Now login in the vaccination-manager portal to see the XSS triggered.
Have a nice day!
FirstBlood ID: 29
Vulnerability Type: Stored XSS
When uploading a vaccine proof it is possible to achieve stored XSS against admins set via the user agent. As this value typically can't be user controlled the developers did not think it was 'worth' preventing against XSS.