FirstBlood-#784 — Stored XSS at /book-appointment.php
This issue was discovered on FirstBlood v2.0.0 (issues patched)
On 2021-10-28, mrrootsec Level 2 reported:
Hello Zseano,Hope you are doing well
When creating the appointment the message field is accepting the client side input without encoding properly and it will lead to Cross site scripting attack
Steps to Reproduce the issue :
Fill the form with required details and add this payload at Extra Comment field and Book Appointment
Note down the Appointment-ID and go to https://bceba5ac7db6-mrrootsec.a.firstbloodhackers.com/manageappointment.php,provide the copied ID and Click on modify appointment.
You can see the POPUP
- As an attacker i can steal the cookies of any user and impersonate them.
Remediation / Fix:
- Implement Input Validation Input validation is the process of ensuring that a web application returns only trusted and proper data in order to prevent malicious data from entering the system and causing harm to the site, users, and database.
- Another great way of mitigating the impact of an XSS flaw can be implementing a robust content security policy
- Use Security Headers Set the X-XSS protection header to “X-XSS-Protection: 0” to disable the XSS Auditor, preventing it from taking the default browser to handle responses.
Thanks and Regards MOHAMMAD SAQLAIN
FirstBlood ID: 22
Vulnerability Type: Stored XSS