SXSS-06: Privileged Viewer — VulnXSS Training Lab

SXSS-06 Privileged Viewer Advanced Unsolved CarePulse Telehealth Desk

Fictional Application

CarePulse Telehealth Desk

Confidential Clinical Patient Helpdesk & Triage

CarePulse is a telehealth platform where patients submit priority medical tickets. Due to healthcare regulations, an automated compliance officer bot (Dr. Sarah Jenkins) reviews submitted tickets every few seconds using an administrative session token. Your goal is to demonstrate stored XSS that executes within this privileged context.

🎯 Assessment Objective

Submit a ticket containing an XSS payload and observe execution when the simulated compliance officer reviews the ticket.

Educational Guidance: Treat this lab like an authorized penetration test. Analyze user-controlled parameters, review browser source code and developer tools, and discover how input is handled.

🩺

CarePulse Clinical Support

Confidential Patient Helpdesk & Triage

Active Patient Triage Queue (2)

+ Open Patient Ticket

Ticket #1041: Portal login biometric prompt timeout

Anonymous Patient #884 • Neurology Triage

Reviewed by Dr. Jenkins

Biometric login keeps timing out on mobile iOS 18 when accessing electronic health records.

Ticket #1042: Holter monitor sync telemetry latency

Patient Ref #319 • Cardiology Care

Awaiting Review

Nightly ECG readings are delayed by 4 hours during peak server ingestion sync.

Active Patient Triage Queue (2)

XSS Successfully Demonstrated!