FirstBlood-#843Stored XSS via cancel appointment functionality
This issue was discovered on FirstBlood v2.0.0 (issues patched)



On 2021-10-29, panya Level 7 reported:

The site allows a user to cancel the appointment on /manageappointment.php page. The page reveals /api/ma.php endpoint, which if used with act=cancel parameter cancels the appointment. But from the page source code, I noticed that it also accepts a message parameter with a reason of cancelling from the user.

The cancelled appointment could be viewed by the admin on /drpanel/cancelled.php page. And if they hover the user appointment, they will see the message.

The message value is filtered on the backend, but the filter can be bypassed with the payload:

"/style="display:block;position:fixed;top:0;left:0;right:0;bottom:0"/onpointerenter="%26%23x61%3B%26%23x6C%3B%26%23x65%3B%26%23x72%3B%26%23x74%3B%26%23x28%3B%26%23x6F%3B%26%23x72%3B%26%23x69%3B%26%23x67%3B%26%23x69%3B%26%23x6E%3B%26%23x29%3B" x="

" to escape the attribute value, style to make the appointment link large and onpointerenter to execute JS-code (alert(origin) url and entity encoded in our case).

If the admin visits the cancelled appointments' page after that the browser will trigger an alert with the text: "https://f35aeb92574e-panya.a.firstbloodhackers.com".

Impact:

An attacker could execute JS-code on behalf of an admin of the site.

Mitigation:

The message parameter value should be properly escaped or sanitized.

P2 High

Endpoint: /api/ma.php

Parameter: message

Payload: act=cancel&message="/style="display:block;position:fixed;top:0;left:0;right:0;bottom:0"/onpointerenter="%26%23x61%3B%26%23x6C%3B%26%23x65%3B%26%23x72%3B%26%23x74%3B%26%23x28%3B%26%23x6F%3B%26%23x72%3B%26%23x69%3B%26%23x67%3B%26%23x69%3B%26%23x6E%3B%26%23x29%3B" x="&id=<appointment id>


FirstBlood ID: 22
Vulnerability Type: Stored XSS

Whilst an attempt was made to fix the stored XSS vulnerability in managing an appointment, it actually introduced new issues such as when creating and editing and not just when cancelling the appointment. Making use of htmlentities() and relying on .value() in javascript to encode certain characters does not prevent XSS overall. The 'fix' to this issue also results in it being vulnerable to admins on cancelled appointments as well.