FirstBlood-#784 — Stored XSS at /book-appointment.php
This issue was discovered on FirstBlood v2

On 2021-10-28, mrrootsec Level 2 reported:

Hello Zseano,Hope you are doing well

Description:

When creating the appointment the message field is accepting the client side input without encoding properly and it will lead to Cross site scripting attack

Steps to Reproduce the issue :

  1. Navigate to the https://bceba5ac7db6-mrrootsec.a.firstbloodhackers.com/book-appointment.php

  2. Fill the form with required details and add this payload at Extra Comment field and Book Appointment

    hackevent';alert(document.cookie);a='hackevent

  3. Note down the Appointment-ID and go to https://bceba5ac7db6-mrrootsec.a.firstbloodhackers.com/manageappointment.php,provide the copied ID and Click on modify appointment.

  4. You can see the POPUP

Impact :

  1. As an attacker i can steal the cookies of any user and impersonate them.

Remediation / Fix:

  1. Implement Input Validation Input validation is the process of ensuring that a web application returns only trusted and proper data in order to prevent malicious data from entering the system and causing harm to the site, users, and database.
  2. Set the HTTPOnly flag of your session cookie and other custom cookies you may have that are not accessed by any JavaScript code
  3. Another great way of mitigating the impact of an XSS flaw can be implementing a robust content security policy
  4. Use Security Headers Set the X-XSS protection header to “X-XSS-Protection: 0” to disable the XSS Auditor, preventing it from taking the default browser to handle responses.

References :

  1. https://rules.sonarsource.com/php/RSPEC-5131

Thanks and Regards MOHAMMAD SAQLAIN

P2 High

Endpoint: /api/ba.php

Parameter: msg

Payload: test';alert(document.domain);a='test

FirstBlood ID: 22
Vulnerability Type: Stored XSS

Whilst an attempt was made to fix the stored XSS vulnerability in managing an appointment, it actually introduced new issues such as when creating and editing and not just when cancelling the appointment. Making use of htmlentities() and relying on .value() in javascript to encode certain characters does not prevent XSS overall. The 'fix' to this issue also results in it being vulnerable to admins on cancelled appointments as well.