BugBountyHunter

I have discovered a stored XSS vulnerability affecting the doctors photo on meet_drs.php

Payload

/x" onerror=alert(document.domain) xss="

To reproduce:

1. Login to the drpanel and pick a doctor to modify
2. Make any modifications you would like
3. Click Save information and intercept the request
4. Add &photoUrl=/x" onerror=alert(document.domain) xss=" to the data and forward the request

5. Visit firstbloodhackers.com/meet_drs.php and the xss will execute

Impact:

1. The attacker could steal a user's cookies.
2. The attacker can steal data from whoever views the page.
3. Users can execute arbitrary JavaScript code in the context of other users.