BugBountyHunter

Summary:

While Editing the doctors data, there is a id parameter but we can input any other character and it is being reflected in the source and then bypassed it to get xss.

Steps to Reproduce:

1. Visit the following link with the payload [note you need to be loggedin as admin] :

   https://7cac14721157-mrxhunt.a.firstbloodhackers.com/drpanel/edit-doctor.php?id=%27)%22%20autofocus%20onfocusin=alert(document.cookie);//

Impact:

The attacker can leak the users cookie and takeover their account.

Underlying Issue

The id value is being reflected in the source without being sanitized first

Remediation:

The parameter value must be sanitized before redirect.