BugBountyHunter

I have discovered a XSS vulnerability affecting the endpoint 'api/ambulances' in the parameter 'select'. The payload requires no filter bypass and is a simple, <img src=x onerror=alert(1)>

You can see a working proof of concept here:

To reproduce:

1. Create an appointment via /book-appointment.php with xss payload on fname and ambulance parameter set to true. (note that there is front end validation on fname parameter which we can bypass by intercepting and changing the value from burp)

2. Now, after step 1, you will get unique AppointmentID which you can use on following URL with select parameter:

https://129454321552-veshraj.a.firstbloodhackers.com/api/ambulances.php?select=<AppointmentID>

You can see that it executes the XSS.

Payload used:"><img src=x onerror=alert(1)>

Impact:

As the session cookies are not protected by HTTPOnly, we can obtain these and achieve account takeover. As well as this, the CSRF token is stored in the DOM which enables us to easily perform actions on behalf of the user.