Stored XSS vulnerability in staff/my-profile.php

[Saud-Ahmad]

Stored XSS vulnerability in Version 2.0 which allows remote attacker to inject arbitrary script or html. This being stored, will impact all users who have permissions to view the vulnerable page.

Vulnerable Endpoint: http://localhost/RemoteClinic/staff/my-profile.php

Step to Reproduce:

1) Login in Application as Doctor. 2) Create New Staff Member.

3) Register as a Doctor.

4) Here is two fields "Chat" and "Personal Address" which is vulnerable to XSS, inject with XSS Payload:

5) Now Click on Register.

6) Profile Created.

7) Now Signout.

8) Login with that Staff Member which you registered as a Doctor.

9) Now go to My Profile.

10) XSS Executed.

[Saud-Ahmad]

CVE-ID assigned for above vulnerability https://nvd.nist.gov/vuln/detail/CVE-2021-31329 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31329

[Saud-Ahmad]

Exploit has been Published by Exploit-DB https://www.exploit-db.com/exploits/49795