FirstBlood-#335 — XSS bypass on cancel report
This issue was discovered on FirstBlood v2
On 2021-10-25, buraaq Level 2 reported:
Getting started
Learn about vulnerability types 
Getting started in bug bounties 
Test your knowledge
Free Web Application Challenges
Guides for your hunts 
ZSeano's Methodology
Effective Note Taking for bug bounties
Useful Resources 
Disclosed HackerOne Reports 
Our community
Endorsed Members
Hackevents 
Member Articles
Hello zseano,
Summary
I have found a bypass for stored xss on /api/ma.php.
Payload : "><img/src="x"/tabinde/onerror="confirm`1`">
POC
Impact
We can take over admin account/session as httponly is set to false.
Run JS code on admin panel
i will reedit this report and more details soon
Kind regards.
buraaqsec
P2 High
Endpoint: /api/ma.php
Parameter: message
Payload: "><img/src="x"/tabinde/onerror="confirm`1`">
FirstBlood ID: 22
Vulnerability Type: Stored XSS
Whilst an attempt was made to fix the stored XSS vulnerability in managing an appointment, it actually introduced new issues such as when creating and editing and not just when cancelling the appointment. Making use of htmlentities() and relying on .value() in javascript to encode certain characters does not prevent XSS overall. The 'fix' to this issue also results in it being vulnerable to admins on cancelled appointments as well.