FirstBlood-#854 — Stored XSS in cancelled appointment
This issue was discovered on FirstBlood v2

On 2021-10-29, twsec Level 2 reported:

there's a stored XSS vulnerability in cancelled patient's appointment

  1. Create an appointment then go to manage appointment and press cancel, before that intercept the request in burp and do the following:

add to the post body, message="><script>alert(document.cookie)</script>&id=...

  1. forward or send the request and while logged in as drAdmin goto cancelled appointments

and a pop up will be revealed with the cookie values

  1. check the source code for the page just to check how it executed.

Impact: an attacker can issue javascript commands to send the cookies to his server thus taking over the victim account.

P2 High

Endpoint: drpanel/cancelled.php

Parameter: message left from patient

Payload: "><script>alert(document.cookie)</script>

FirstBlood ID: 22
Vulnerability Type: Stored XSS

Whilst an attempt was made to fix the stored XSS vulnerability in managing an appointment, it actually introduced new issues such as when creating and editing and not just when cancelling the appointment. Making use of htmlentities() and relying on .value() in javascript to encode certain characters does not prevent XSS overall. The 'fix' to this issue also results in it being vulnerable to admins on cancelled appointments as well.