Open Bug Bounty ID: OBB-1004784
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:
      a. verified the vulnerability and confirmed its existence;
      b. notified the website operator about its existence.
Affected Website: |
mofosfree.com |
Open Bug Bounty Program: |
Create your bounty program now. It’s open and free. |
Vulnerable Application: |
Custom Code |
Vulnerability Type: |
XSS (Cross Site Scripting) / CWE-79 |
CVSSv3 Score: |
6.1 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N] |
Disclosure Standard: |
Coordinated Disclosure based on ISO 29147 guidelines |
Discovered and Reported by: |
KhanJanny |
Remediation Guide: |
OWASP XSS Prevention Cheat Sheet |
Export Vulnerability Data: |
Bugzilla Vulnerability Data |
JIRA Vulnerability Data [ Configuration ] |
|
Mantis Vulnerability Data |
|
Splunk Vulnerability Data |
|
XML Vulnerability Data [ XSD ] |
|
Vulnerable URL:
![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAABLCAIAAAAphcDFAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAazklEQVR4nO2dfUxb1/n4b4gDjjEvcYxrMAFDqBNRRgmLKIkYYkkWIQ8ht0tYhGjDGEopQkmGkghYxhjJnIzSiJKKoSqJaJJlXZUiiiJGI4Y6jyFKCHOpxZhHmWGug8ChhDrMpST398f55eh875uvAYOTPp+/7j33nOPnec5jH9/z8px1NE1TAAAAAOADAtZaAAAAAOCZBfoYAAAAwFdAHwMAAAD4CuhjAAAAAF8BfQwAAADgK6CPAQAAAHyFX/QxcXFxn332Gd8t4G88qw3kV3r5lTAAsGTWvo/5/PPPHz9+/OKLL3LeAv7Gs9pAfqWXXwkDAMvBQx8zPj4eEhLC+ejBgwfnzp3juxVPe3t7bm4u3+1TwS9+8YuNGze+9957q1x2TVhmA3n0EwGX88hyyiK9cA3kxaZNm1ZNDFIYdlV+7i1Pl7TAKkELYrPZ5HK5mEcCOYVJS0u7ffs2363/43Q6AwICzGbz4uLiapZdK5bZQB79ZMmOtMyySC9cA3kRHh6+amKQwjCq8n9vebqkBVaHNR4ru3fvntVqzcrK4rx9KnC5XDKZ7MUXX1y/fv1qll0TnsYGEgPWSyKR6HQ6iqLYF6svDCP96fKWp0tawHeI6mPefvvtuLi4zZs3v/rqqw8ePKAo6sGDB1qt1uVyrVu37r333iNvL1y4EBIS8uabbz733HObNm06fPjw//73P76a29vb9+/fv2HDBsbtyy+//Oabb6LEzz77LCgoCH0uRVGvv/76888/L/D05MmTwsVPnjyJBUBv92+99VZcXFxwcPBPf/rT+/fvnzx5MiIiYvPmzT/72c8ePnyIcj58+PD111+PiIjYsmXLb37zm0ePHlEUdf/+fdIOfNnu3Lnzgx/8ICQkRKPR/OQnP/nnP//JKIuMdu7cuYiIiMjIyMuXL1MU9c033/z85z8PCQmJjY399a9/jaoSSMc8evSosrLyueeeCw4OPnjw4P379/lUEK++Vw108uTJO3fu7Nq1a+PGjREREQcPHvzyyy/ZbiMgKtvlSJDYfD7GWVa4CNZLo9HcvXuXoijy4tNPP6WWwccff+xVBsaXAuHRWzgNLr59+ZzKW+HXVlrAD/Hcx7hcLrPZ3Nvb29/f73A4KioqKIoKCwsbGRmRy+Vut7ugoIC8ffnll10uV39//8DAwMDAwODgYF1dHV/lfJMxOTk5XV1dKPHWrVuPHz/u7OxEt11dXQaDQeCpXq8XLq7X69kK9vT0mM1mh8Oxfft2p9M5NDTU19dns9mqqqpQtqNHjzocjsHBwc7Ozvb29qamJoqiNm/eTNqBL1tOTk5hYeHExERPT09GRoZUKmWURUYbGRmxWCwtLS0ZGRkURdXW1s7Pzw8NDXV2dppMpubmZiQJXzqmrq6uq6urq6vLarVGRUUNDw8LqCBSfa8aSK/XDw4OHjlyZHJy0mKxREdHl5WVsd2GT1ROl2PA52MCZQXc0qezgIWFhXv37kU9FoM7d+7s3bu3sLCQTOQUxqO3cBqcEt2+fE7lrfBrKy3gjwgPpdlsNoqi5ubm0G1vb298fDx+xDkfg4pMTEyg9NbW1p07d6LriYkJrVaLi7hcLrlcPjMzw751OBwymcztdtM0nZaWVl5enp+fjyoPDQ2dmJgQeLqwsCBcfGFhgaHg7Owsuu3p6QkICJifn8f6JiQk0DS9uLgol8vHxsZQent7e3p6OtsOnNlmZmYkEgkShm1e0mjYFAilUulyudC12WxOS0sTTseoVKrBwUFGIqdsItX3toFIC9M0PTo6qlar2ebiFFXA5Rh52D4m7K58bsnww+XD0NHlchmNRoVCkZeXZ7VaUaLVas3Ly1MoFEajEbcmWxiyKmFvIcEGF9++fE7llfBrLi3gh3g350/Ofwr0MVKpFKcPDw+rVCp0vbi46HA48KPW1tY9e/bw3aakpHR3d09OTkZHR8/OzqpUqsXFxUuXLr3yyisen4rJ4FFB8tbhcAQGBuJ0q9XK+aPJl+3QoUMpKSnl5eX19fWffPIJp9EYs8QzMzMURSmfoFAokBn50jGzs7MSiYQ90copm0j1EV410ODg4L59+6KiopCQnG7DKaqwSDiR08eE3ZXPLRl6CaAkEEjknPOfmZkxGAwSiQTdSiQSg8GAf08xDGH4frXZ9XMaXGT7enQqkcL7ibSAXyFZjXelJ6xfvz4yMhLfCq9a1uv1XV1dY2NjOTk5YWFhKSkpJpMJj3QJPxWTYTX54x//ePfuXYvF4nA4ysvLd+/effHiReEibrc7ICBgYGBAIvn/bRQQECCQzsAXE61eNZDBYCguLm5ubpZKpXa7PTs7m6/aNZ8TFj9QZjabRSYy+OKLL6qrq00mU21tLUqpra2tr68vLS2tra3dunXrEoRhIN7gbISdSrzw/iAt4HcId0FLe4+hiEGJtrY2PChBsri4qFQq8dAN45am6d7e3rS0tNzc3I6ODpqmm5qajh49qlar0ZuQ8FMxGTwqSN4uZ6yMobjZbI6OjmYbjf1fTy6Xs4e8BNIxKpXKbDYzEvnGykS+x3jVQFNTU/g/L1KZz23Yoop8j+H0MWF35SzC1mvFKSkpkcvl5eXlTqeTTHc6ncePH5fL5SUlJSiFLYzINwM+g4tvXz6nEi+8P0gL+CFL72NcLpdEIsFDtPgWfZkPHDhgt9stFktKSkpNTQ2uAU9LmEympKQknM64RahUKpVKhYrY7fbQ0NCUlBSRTz1mQOni3bq4uDg3N3diYsJisaSmpjY2NnKaiJ1teHg4Ozu7u7vb6XROTEwUFxfn5OQwynL2MSUlJenp6ejtp66urra2Vjgd29ZoNKalpQ0NDdnt9rKyMpPJxCebePW9bSCVStXU1DQ7O2u1Wg0GA5/bsEUVEAkryOdjHvsYdhFOvZYPOf1WUFBgs9n4ctpstoKCAnTNFkb86BOnwcW3L59TiRfeH6QF/JClv2MGBwefPn06JSUFLULFtx9++KFcLt+5c2dqampGRkZycvKpU6dQkfHxcaVSia7FbO/ft29fZmZmUFAQRVEajUan05EjXcJPhTOQkoikoaFBrVanpqZmZ2fn5uaWlpaKzJaQkJCenl5SUhIVFbVz5063233p0iWRn5ienp6dnZ2QkPDJJ5+ghVh86aRGp06dysrK2rNnT0JCgt1uT0xM9EoFTrxtoJs3b165ckWtVmdmZsbHx+MiDLfhE5UNo8n4fEwAziK+WFHGEPXatWuxsbF8mWNjY69du4aulyMMn8FFwuds4oX3B2kBf2TFey3Ovy1sdDpdX18f3y3gb/hVA4n0MTFF/EovvxIGAFaEVZ3zJ/nXv/4lcAv4G89qA/mVXn4lDACsCF6MlUGwcRKwBvC0Az68tnxH7C+2j4Fg4yRgDeBpB3x4bfnu2F9sH4NnI7/++utjx47FxsZu3Lhx27Ztv/vd7xjBgmJjY7/++muBqsbHx9c9YcOGDd/73vf+9Kc/LVkBkXgU2yvIudmLFy9u3bo1KChox44df/7zn8lsf/3rX3fs2BEcHLxr167PP/+cs6oPP/zw1VdfpSjqo48+Onz4sEhdIiMjyXEV0qSYt99+e/lB5nH9ZHx7MXr5CKSRRx9js4QiDFCkehR9azn1YATMuFINJ4BIHyZda/369XFxcWfOnEHfHT6vQ4/Wr1//t7/9jVEV9iJG2S1btlRWVn777bd86jM88OLFiyim2UsvvfSXv/yFU1p2tQKaCn+iR3XYdli3bl1ISAiKTIj4wx/+sG3bNvyzQ9p/Db9Qq4HIeRscbPzAgQMGg2FkZGRqaqqrqysrK6u/v9+rKSA0++p2u91u99TU1Pvvv69UKm/duuX1XJI3LF9sEmyNxsZGrVbb1dU1NTV148YNhUKBFwrTNK1Wq9va2mZmZmpqajg3CdE0ff78ebTysq6u7uzZs2I+/ezZsydOnCBTSJNiFhcXlzA3zgljFakYvXzESmnkLWSkes6wQEtAwIyroKZIHyZda35+HgVuQR7L53X0k5Xi8fHxjEgzjG1SuFqLxbJ79+7Tp0/zqU+WbWxsjI+PR5sBbt68qVQqe3p6xFQroKnwJ3pUB33iyMhIeHg4NsXx48dfe+01nD85ObmlpYVtf3pNv1CrgKg+xuFwhIeHLywszM/PSyQSdgwJr2A3Z3Nzs16vX06dwqyI2BhsDZqmo6Kiuru78aOGhga894WmaaVSabfbaZq+detWcnIyZ21FRUXvv/8+uvjggw88fvrc3FxSUhIOyYXg+0nyUR8jRi8fsVZ9jC8+V8CMvlZTvA+zJenp6UlMTBQW0mazyWSy1NRUxg5Nvq24NE339vZu376d7ylZliFwc3Mze8MZZ7UCmnrsY4TV4UxxOBxyuRztLuro6IiPj8dhk0j702v6hVoFRPUxzc3NeXl59JMNdGRnjkAtZDQalUqlWq2+dOkSTdOLi4sVFRUqlUomkx04cADvE2Y35+DgYExMDLp2uVxHjhxRKpXR0dE1NTWoVfiq8khnZ6eA2DRN5+XlkW8P6enp6L+Gw+HQ6/VyuVyr1dbX15Oug60xOztLURQZ/3FwcJAM4FhdXZ2cnFxaWpqcnGyxWNifzvdmOTY2JpPJ0E5mp9MZHh6OvxtGo5H8N4QQ2cdw2ra/vz89PV0qlSqVSrRFEWW22+379++Xy+U6nc5oNJIWENbL7XYXFRXJ5fKYmJjq6mr8vUIVymSy+Pj4CxcueNx2xykYI39/f39GRoZcLo+KinrllVeGh4cZwvB5DtsUqOb6+nqtVhseHp6fn4//lDidTtw6b731FmObIen2ZCUymSwvL8/pdJ44cQKF1SosLCSdUMCM7M2MdXV1KpUqPDz8tddew2EiBUzE+DIyEO/DbNcaGBjQ6XScjxilLBaLVCrF/9aF+5iBgQG+eLtkWbbACwsLeJeoQLXCmnrsY4TV4UspKysrLS2laTozM/Pdd9/F6dj+CI+ewPYxTn/wT0TNx+Chw+DgYL1ef+jQob///e+Mk0XY4bv5IsyzUSgUc3Nz6Joz/jxfVREscJ1k4HEBsfPy8tra2tD1vXv3zGazwWCgKKqsrCwwMHB0dLSrq+vq1auc1nC5XFKplDznIzQ0FCtCURSK3dLS0tLZ2fnCCy+wFXe73TExMQ6Hg7ygKCouLq6qqur48eMURVVXV+v1+h/+8IcURT18+PDChQu1tbUajeaXv/ylt1NKnLbli7JeVlYWGho6PDzc0dFx48YNsh5hvfjirqMKR0ZGbt++3dLS4lFaPsFIOA9NIPH2mIOhoSF0LsDExASOJM+IVE/Wz3Z78WcleHQP8lM4TyUQiJDPkIqBeB9mMD09ffr0afQd8cgLL7xQU1NTVFTEPgGIwVdffVVdXV1cXOyxTrbAGzZs4NslSlbrraZsxKuDqaiouHHjxkcffWSz2chDEBibbYU9gdPHRB6e4hd47IUYwcbn5uYqKip0Op1EIklISMD/ASlW+G7OCPO04F8GvnhffFXZWdA8gcc5xaZpen5+Hh0WQNN0U1NTbm4uEkMqlWIxWltbyVAo2BpsRcbGxnDOS5cuJScnT05OZmVlZWdn0zQ9OjrKCBDrdrtRsF58gVlYWNi+fXtNTY1SqZycnESJ9fX1BoPB6XSOjo4mJSWR8WwoIhKtUqksKytjSCgmlhqOso4sQEbCF68XZ9x1vgqFw4ewBSPz8x2aQB4h4e0xB3gQsqenh/PvPOMNg+H2NtHR6YXNyP4UzlMJ+EzE/jKSNhHvw/T/dS2FQiGVSktKSnAcJk6vI6tdXFxMT09H0xLsGQ5cbUBAADICW32cwnYY9IKoVCoZJzhwViusqZj3GAF12EUwJSUlUqm0qakJpzB+UT16AqePefQH/8FzH8MX+dztdvf29qanp58+fZrdQnwR5mnB5uSMPy9QFSd8gcfZYqOUQ4cOoR/rffv2Xb9+nS3G8PAwdh3SGna7nQwXT9P06Ogo7irwr5vD4VAqlUajsa+vjwyYhr4GEomEvCBrQ4eA4Y6EpmmdTod9q729HfsWGi8m+1r2LwjfuQOcUdYdDgcjEj62gLBefHHX+SoU6GPEhH/nPDQBHyGxsscccPYxbE8WGXFL2IyMT+E7lUCMiRg2ob3xYfr/upbD4SCNyed1DBmsVqtMJmtra2PPcOCCJpMpNTW1oaFBwLCoLCnw7Oys3W7v6+sTU62wpiL7GD512EUwQ0NDUqmU/CfE+EUV7wk4hc8f/BPP+/z5YigFBQXt2rWrsbGxoKCA7yVXZNj2mZmZ0NBQ4TycVZGDY4jp6WnhwOOk2GfOnKEoKi8v75133ikoKOjv729tbRUWg7QGGjz59ttv8Qv43NwcUmR6enpmZmbHjh0URUVGRra0tBgMhoGBAXLgwmw23759u6Ojo6Ghobu7+4MPPmAc5zc5ORkQEDA5OYluv/rqq7GxsS1btqBbnU7ncDhw5oCAAI1GIyw8J15FWfeo1wrGXRcjGOehCYwjJNb87AA2YtxDDF4doIBtItKHMQKuJcbrnn/+eaPReOTIkY6ODr6yGo2msbGxqKjo2LFjFEWh4+8ePXqE287lcslkMobAYWFhYWFhU1NT6JFwtcKaCnyiSHX4CA0NlUgkKKYfgrT/SnmCP+Ph+//o0aNbt26RfQxjPgOtVmQXDAsLUygUInex9vf3JyUlURSlUqkCAwP/85//oPSRkRGtVitQlZkFRVGVlZVWq1WlUqWkpLzxxhsexdbr9Waz+erVq/v27UNr5FUqVUBAwPj4OBaD0xphYWFRUVE9PT24WrTkhqIo9F7y73//G6X/+Mc/Lioqam1tLSkpwZk1Gs38/LxOp0MX27dvJ7+uDx48OHHixI0bN5qbm9Eqe5lM9vjxY9I4MTExYsyL4LTt9PS0w+H41a9+tXXrVo1Gg+czVCoVRVH//e9/0a3VakUXHvWKjIyUyWQzMzOaJ6CfNoEK5+fn8c4Vu92OLvgEY/P973//8OHDlZWVV65cwVNrCD7P4TSFKCOuEGLcg8TtdpOmQ+0u3kQk4n14BTl27FhiYiLnjBoGvXGi64iICIVC0dfXh5+aTKbk5GQscG9vL37U3d2NHglXK6ypwCcuTR0+GPb31hMQnP7gvwi/5jCCjY+MjKhUqnfffdfhcMzOzqKnRqOR8/WcL8I8uYbd6XQy9sdwhtDnq0oY25PA43xi45z5+fmhoaHk0mG0n8Zms1ksluTkZPQKzA69jlfcI0XIFfelpaW7d++2WCxOp7OlpQUtC8EDdIhTp041NzfTNF1VVUWOiaHiaOXJ2bNns7KyUKLBYMjOzrbZbENDQ4mJiVeuXGGblNypMDc3J5FIRkZG0BAHp235gvAbDAYyEj5O96gXX9x1vgrT0tKKi4snJyetVmtGRgY5msQWjNSI79AEl8uFl96t4DEHKztWJmxGUk0b/2EZYiLkI7BNvPJhvtrIR3z7Y9iTH3K5nHN/jNvtHh4ezszMREuwEO+8845OpzOZTGgTjEKhwJtg8P6Yqamp69evKxSK3t5eMdUKayrwiR7VYbcvnwHZ9hf2BE4f4/MH/8RDH3PixImqqioypaOjIysrKzQ0VCaTJScnowV5fEPAp06dUiqVUqkUzVSjdGQjhEQiSUxMRBtEEHxrlzmrEg+n2Ji2tja5XE4uAZycnMzJyUFrl8+fP49ch20N+onHBwYGpqSkoNO6EG63u6KiQqvVSqXS1NTU69evoxXJpFvn5eWhIvn5+W1tbTh9YGBALpejqRe3263Vaq9evUrTtNPpzM/PVygUMTEx58+fx/lJk2LQMHRFRYVMJkO/L5y2NZlMO3fulEqlarW6vLwcf0nItcvk6m2PeqHdZ9HR0TKZTK/X46l1cu0yWeHo6OiePXvkcnliYmJjYyN5Yg2nYFijhYWFmpoanU4XGBioUqkKCgrQ4gjGSgdOz+Fbu0ya1Kd9jEczYjVRnefPn2evVeU0EeeXESd65cN8teFHfF7HWaq5uZkx549RqVRHjhxh7Pq6cOGCVqsNDAxMSkpqbW1lCIwepaamkltePFYroKnAJ3pUB2fz2Mew7S/sCXw+xukP/omHPgaCjdNPXoNosMbKwbd+bKUq9+kGxlVmRdTBlYAPry3Lt/9T594e5vwh2DhFUWazGR2jBNZ4WiD3IgAIZBPw4bXlO2j/pZ+DueL4VaTrM2fOXL58eXp6+tNPP62qqhKeggP8CrVa3dDQsNZS+BdgE2Ct8Jc+xt8iXWdlZTU1NUVHRxcUFBw9elRkRGTAHwgKCvLD9cprC9gEWCvW0TxRs1aZ3/72t5OTkxcvXlxrQQAAAIAVw1/eY/h2egIAAABPL37xHnPv3r3ExMSpqSkyYh0AAADwtOP5PebOnTu7du3auHFjRETEwYMHv/zyS3Rm3Llz5yIiIiIjIy9fvswo8vHHH3NWxZfe3t6+f/9+6GAAAACeMTz3MZzxw4WDhxcWFu7du/fu3bsi02GgDAAA4NnEq900KH64mODhRqNRoVDk5eVZrVachzOdEekaAAAAeGbw/B7zj3/840c/+pFGo4mIiEhLS0OHaMnl8k2bNpHZyEB1wcHBlZWVo6OjCwsLZHw9zvTbt2+npaUxagMAAACeATz3MQaDITMz02Qymc1mgXDWjIDqX3zxBQpBWFtbS2Zjp8NAGQAAwLOKhz5mafHD33jjjZSUFLVabbVaKysrBdLZZwcAAAAAzwwe4pWhYxV+//vf5+fnT01N1dTU8OV8+PDhzZs30X54l8tlsVjYh2yz03t7e9VqdVxc3NI1AAAAAPwVz2NlN2/evHLlilqtzszMRKEhOXE6nfjQnmvXrrE7GM50GCgDAAB4hlmxPZjj4+NJSUn4QEORbNu27erVqy+99NKKyAAAAAD4FR7GyrxiCQHVv4ORrgEAAL47rNh7zDfffCORSCC2KwAAAIDxi3hlAAAAwDOJv8RdBgAAAJ49oI8BAAAAfAX0MQAAAICvgD4GAAAA8BXQxwAAAAC+AvoYAAAAwFdAHwMAAAD4CuhjAAAAAF8BfQwAAADgK6CPAQAAAHwF9DEAAACAr4A+BgAAAPAV0McAAAAAvgL6GAAAAMBXQB8DAAAA+AroYwAAAABfAX0MAAAA4CugjwEAAAB8BfQxAAAAgK+APgYAAADwFdDHAAAAAL7i/wH3d5qHvKlK7gAAAABJRU5ErkJggg==)
Screenshot: ![mofosfree.com vulnerability](/twimages/screen-1004784.jpg)
Mirror: Click here to view the mirror
Coordinated Disclosure Timeline
Vulnerability Reported: |
27 October, 2019 17:21 GMT |
Vulnerability Verified: |
27 October, 2019 17:30 GMT |
Website Operator Notified: |
27 October, 2019 17:30 GMT |
a. Using the ISO 29147 guidelines |
![](/images/done.png) |
— |
— |
b. Using publicly available security contacts |
![](/images/done.png) |
c. Using Open Bug Bounty notification framework |
![](/images/done.png) |
d. Using security contacts provided by the researcher |
![](/images/done.png) |
Public Report Published |
|
[without any technical details]: |
27 October, 2019 17:30 GMT |
Vulnerability Fixed: |
7 December, 2019 16:50 GMT |
— |
— |