# Template stored XSS

Template field names in drchrono's form builder were stored unescaped, letting an attacker inject SVG/HTML that executes JavaScript on the shared public form and search pages.

- Payout: hidden
- Severity: medium
- Program: drchrono
- Found by: s_p_q_r
- Disclosed: 2016-07-21
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/141198
- Library page: https://bugbountylibrary.com/r/h1%3A141198
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:medium tech:rest technique:second-order vuln:xss

**Target:** Advanced form builder template field names and public medical-forms pages
**Root cause:** Template field names are stored and rendered without HTML escaping in the form builder, the shared library form page, and the search results page.
**Steps:**
1. Log into the account and open `https://%your_domain%.drchrono.com/clinical/advanced_form_builder`
2. Create a new template with a field named `<svg onload=alert(document.domain)>`
3. Save the template and share it to the library
4. Visit the shared form page (e.g. `https://www.drchrono.com/medical-forms/1460752/aaabbbcccdddeee`) to trigger the payload
5. Alternatively trigger via search: `https://www.drchrono.com/medical-forms/?query=aaa%22bbb%27ccc%3Cddd%3Eeee` with an onmouseover payload
**How found:** Noticed that template field names were reflected/stored without escaping and tested HTML tag injection in the field name, then confirmed execution on both the shared form page and the search page.
**Exploitation:** Attacker creates a template with a malicious field name and shares it to the public library; any user viewing the shared form or searching the library executes the injected JavaScript in the drchrono origin.
**Insight:** Field/column labels in form builders are often stored and rendered raw across multiple surfaces (builder, shared public view, search) — test the same injected name on every page that displays it, since escaping is frequently fixed in only one place.