FirstBlood-#395 — Stored XSS found on /manageappointment.php?success&aptid={id}
This issue was discovered on FirstBlood v2

On 2021-10-25, d20s84 Level 3 reported:

Hi ! I found a stored XSS. Read the following for details

Summary:

Javascript payload can be injected in the message field of the appoinment which would lead to stored XSS.

Steps to Reproduce :

1.Book an appointment by entering valid credentials on /book-appointment.php. Fill in the details , submit and note the id generated.

  1. Go to manage appointment and enter the appintment id.
  2. Enter random strings in the message field and click on modify Button. Intercept the request.
  3. Add the payload to the message value in the body field.
  4. Go the the above url.
  5. Boom! the payload triggers.

Image of the occurrence of the triggered payload: Source Code of the manage appointment page after the payload triggers: Burp repeater screenshot:

P2 High

Endpoint: /manageappointment.php?success&aptid={id}

Parameter: msg=

Payload: anksj';alert(document.domain)//

FirstBlood ID: 22
Vulnerability Type: Stored XSS

Whilst an attempt was made to fix the stored XSS vulnerability in managing an appointment, it actually introduced new issues such as when creating and editing and not just when cancelling the appointment. Making use of htmlentities() and relying on .value() in javascript to encode certain characters does not prevent XSS overall. The 'fix' to this issue also results in it being vulnerable to admins on cancelled appointments as well.