FirstBlood-#1589 — Stored xss on api/ambulances.php
This issue was discovered on FirstBlood v3

On 2022-12-11, didsec Level 5 reported:

I have discovered a stored XSS vulnerability affecting the /api/ambulances.php endpoint via the parameters fname and lname when booking an appointment.

Payload

"><svg/onload=alert(document.domain)>

To reproduce:

  1. Visit firstbloodhackers.com/book-appointment.php and fill in the information required to make an appointment
  2. Click Book Appointment and intercept the request
  3. Replace the fname or the lname with the payload and add &ambulance=1 to the data
  4. Take note of the created appointment ID
  5. Visit firstbloodhackers.com/api/ambulances.php?select={ID} and the xss will execute

Impact:

  1. The attacker could steal a user's cookies.
  2. The attacker can steal data from whoever views the page.
  3. Users can execute arbitrary JavaScript code in the context of other users.

P2 High

Endpoint: /api/ambulances.php?select={ID}

Parameter: fname and lname

Payload: "><svg/onload=alert(document.domain)>

FirstBlood ID: 53
Vulnerability Type: Stored XSS

It is possible to achieve stored XSS on /api/ambulances.php?select={id} via the users first/last name. For this to work the parameter ambulance=1 must be set