BugBountyHunter

I have discovered a stored XSS vulnerability affecting the doctors bio that is vulnerable on the about.php page

Payload

<img/src=x onerror=alert(document.domain)>

To reproduce:

1. Visit firstbloodhackers.com/api/managedoctors.php and intercept the request
2. Change the request to a PUT request
3. Add the following JSON to the data and forward the request. You must use drId 3 (Jon) as only this doctor appears on the about page

   {"name": "Edited",
   "bio":"<img/src=x onerror=alert(document.domain)>",
   "tagline":"Even more editing here",
   "drId":"3"
   }

4. Visit firstbloodhackers.com/about.php and the xss will execute

Impact:

1. The attacker could steal a user's cookies.
2. The attacker can steal data from whoever views the page.
3. Users can execute arbitrary JavaScript code in the context of other users.