BugBountyHunter

The site allows a user to cancel the appointment on /manageappointment.php page. The page reveals /api/ma.php endpoint, which if used with act=cancel parameter cancels the appointment. But from the page source code, I noticed that it also accepts a message parameter with a reason of cancelling from the user.

The cancelled appointment could be viewed by the admin on /drpanel/cancelled.php page. And if they hover the user appointment, they will see the message.

The message value is filtered on the backend, but the filter can be bypassed with the payload:

"/style="display:block;position:fixed;top:0;left:0;right:0;bottom:0"/onpointerenter="%26%23x61%3B%26%23x6C%3B%26%23x65%3B%26%23x72%3B%26%23x74%3B%26%23x28%3B%26%23x6F%3B%26%23x72%3B%26%23x69%3B%26%23x67%3B%26%23x69%3B%26%23x6E%3B%26%23x29%3B" x="

" to escape the attribute value, style to make the appointment link large and onpointerenter to execute JS-code (alert(origin) url and entity encoded in our case).

If the admin visits the cancelled appointments' page after that the browser will trigger an alert with the text: "https://f35aeb92574e-panya.a.firstbloodhackers.com".

Impact:

An attacker could execute JS-code on behalf of an admin of the site.

Mitigation:

The message parameter value should be properly escaped or sanitized.