DOM xss found on management portal

FirstBlood-#912 — DOM xss found on management portal
This issue was discovered on FirstBlood v2

This report has been reviewed and accepted as a valid vulnerability on FirstBlood!

On 2021-10-30, vishal Level 2 reported:


Discription:stored xss in message left at the time of cancelation of appointment.
Steps to Reproduce:


visit /book-appointment.php & create an apointment.



copy appointment id you will recieve.



visit /yourappointments.php and using your appointment id retrieve appointment.



now click on modify appointment and capture request in proxy & send it to repeater tab.



Now you will need to make some changes into request add message=';alert(document.cookie)' in request as below .



Now All you need to do is reload step 4 web page.



All done you should probably get stored xss popup just as me on this page .
In any case if something is missing
Just let me know - Vishal

This report has been publicly disclosed for everyone to view

P2 High

Endpoint: /book-appointment.php

Parameter: message

Payload: ';alert(document.cookie)'

FirstBlood ID: 22
Vulnerability Type: Stored XSS

Whilst an attempt was made to fix the stored XSS vulnerability in managing an appointment, it actually introduced new issues such as when creating and editing and not just when cancelling the appointment. Making use of htmlentities() and relying on .value() in javascript to encode certain characters does not prevent XSS overall. The 'fix' to this issue also results in it being vulnerable to admins on cancelled appointments as well.

BugBountyHunter

Discription:stored xss in message left at the time of cancelation of appointment.

Steps to Reproduce: