Stored XSS on vaccination-manager/portal.php

FirstBlood-#678 — Stored XSS on vaccination-manager/portal.php
This issue was discovered on FirstBlood v2

This report has been reviewed and accepted as a valid vulnerability on FirstBlood!

On 2021-10-27, shivam18u Level 3 reported:


Hi Sean,
I found a stored XSS on /vaccination-manager/portal.php
The data from User-Agent header is not sanitized properly. 
When uploading the proof of appointment, intercept the request and edit the User-Agent header.

Submit the request. 
Now login in the vaccination-manager portal to see the XSS triggered.

Have a nice day!

This report has been publicly disclosed for everyone to view

P2 High

Endpoint: vaccination-manager/portal.php

Parameter: User-Agent

Payload: </td><script>alert(document.domain)</script>

FirstBlood ID: 29
Vulnerability Type: Stored XSS

When uploading a vaccine proof it is possible to achieve stored XSS against admins set via the user agent. As this value typically can't be user controlled the developers did not think it was 'worth' preventing against XSS.

BugBountyHunter