eco-sapiens.com Cross Site Scripting vulnerability

2019-10-3117:31:00

MrRain_1996

www.openbugbounty.org

JSON

Open Bug Bounty ID: OBB-1006591

Security Researcher MrRain_1996 Helped patch 956 vulnerabilities
Received 4 Coordinated Disclosure badges
Received 9 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affectingeco-sapiens.com website and its users.

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:

&nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence;
&nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence.

Affected Website:	eco-sapiens.com
Open Bug Bounty Program:	View Open Bug Bounty Program
Vulnerable Application:	Custom Code
Vulnerability Type:	XSS (Cross Site Scripting) / CWE-79
CVSSv3 Score:	6.1 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N]
Disclosure Standard:	Coordinated Disclosure based on ISO 29147 guidelines
Discovered and Reported by:	**MrRain_1996 Helped patch 956 vulnerabilities
Received 4 Coordinated Disclosure badges
Received 9 recommendations **
Remediation Guide:	OWASP XSS Prevention Cheat Sheet
Export Vulnerability Data:	Bugzilla Vulnerability Data
JIRA Vulnerability Data [ Configuration ]
Mantis Vulnerability Data
Splunk Vulnerability Data
XML Vulnerability Data [ XSD ]

Vulnerable URL:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAAA3CAIAAABVZQ1/AAAACXBIWXMAAA7EAAAOxAGVKw4bAAASQUlEQVR4nO2dfUxT1xvH77CUUgpILRVpVUBXCSGOGEZwc86ocYRVUjfEjXUTJ8GXMGcIMofOMbahUWTMEUKWuaAxm1mMIc1CmOnMQkjnfOlqR1htGMOKhUFFwIoVa+/vj/Pbzd19Ob28VAo+n796Ts/L9zzPvX16T2+f+wxJkgQAAAAABICQ6RYAAAAAzFogxgAAAACBAmIMAAAAECggxgAAAACBAmIMAAAAECggxgAAAACBInhjTGJi4vXr1/mKwAwlSPwYJDIAYNYTpDHmjz/+8Pl8zz33HGcRmKEEiR+DRAYAPA34iTE3b96MjIzkfGt4ePjw4cN8xUliMBhycnL4ik85GKcEOUHixyCRMRkmcAzcvXt327ZtsbGxKpXqgw8+ePToEWaQmzdvxsTETIVS4Gln4tcxQ0NDVVVVfMVJAjEGw+LFi10u13SrmAhB4scgkfGEKSgoGBsbs1gsFy9eNJlMhw4dmrkHEjCDCMa9st7eXrvdvmbNGs4iQBBEWFjYdEsYN0HixyCR8YR58OCB2Wz++uuvVSrVsmXLampqzp07R8zMAwmYWQiKMV9++WViYuK8efPefvvt4eFhgiCGh4cTEhLcbvczzzxz6tQperGmpiYyMvLYsWPz58+PiYnZunXrgwcP0DhXrlx56aWXIiMjVSrV66+//ueff3JOZzAYNmzYEBoayihu2rTp2LFjqPL69ethYWFIDEEQO3bs2LdvH77Bs88+i+/OkPHw4cPt27dHRkYuXrz4448/fvz4MUEQjx8//vDDD+fPnx8REbF58+Y7d+6gxvfv39+xY0dsbOzChQs/+eQT1JgTTiNcuXJl5cqV4eHhsbGxmzdvvn37NvHvfgjbkvQtDk6RqMHx48cTExNjYmLeeustaqVCXMC5Rs4F0ieKiIjYsmXLnTt39u3bFxsbO2/evG3btt2/f5/tVr514WfB24Ggbe9gxmfLECIe453Dhw/HxsYuWLDg5MmTBEHcvn37lVdeiYiIWLJkyRdffEHXw9bJ5z46+LWwT0y+9uHh4bdu3YqIiEAdOzs74+PjGcKQ+MjIyGXLln333XecRy8nP/30E2Uo9tG1ZcuWzz//nGq8cuXKU6dO9fb2vvrqq5GRkYmJicePH4d9uVmM/xjjdrstFovJZLp8+bLT6dy/fz9BENHR0TabTSaTeTwevV5PL27atMntdl++fPnq1atXr141m81Hjx5FQ2m12oKCAofD0dbWtmrVKolEwjkj30aZVqs1Go2o8scff/T5fC0tLahoNBqzs7PxDXQ6Hb47Q0ZlZeXo6KjVam1paWltbW1oaCAI4ujRo0aj0Wg02u32+Pj4jo4O1HjPnj1Op9NsNre0tBgMhvr6ej57chrBbDYXFRX19fW1t7er1eri4mLK+JyWxItEHa1WK/Kaw+EoLy8X7gLONfItEB0ebW1tFovF6XQmJye7XC6r1Xrp0qXu7m5qXoZb+daFmQVvBwaY9gwZQsRjvGOz2drb2xsbG1etWkUQRHFxcVRUlM1mu3DhQmNjI14kxn1C1sJ5Ygqx1Y0bN0pLS6urqxn1SHxHR0dzczM9xsSyoN66cuXKunXrCgoKUJHz6MrLy2tqakINent7LRaLTqcrLi4Wi8WdnZ1Go/H06dN+DQXMYEgs3d3dBEGMjIygoslkSkpKot6SyWT0lqiIujgcDlR//vz59PR0kiQHBwdFIpHH42HP4nA4EhIS0Gu32y2TyQYHB9lFp9MplUrRCBkZGSUlJfn5+WjGqKiosbExfAOHw4HvzlClUCjcbjd6bbFYMjIySJJUKpVms5nR0uv1ymSyrq4uVDQYDJmZmZz2xBiBorOzMy4uDmNJuuU5RTK81tbWhrwmZHbONfItEE00NDRETRQSEjI6OoqKJpNp6dKl6DXdj3zrws+CtwMqzp07F9OeU4YQ8XQY3qEOVKRfIpHQ56X0cOokedxHB7N2zhMTs3ZET09PUlLS2bNnGcL4xKMuDEiStNvteXl5crm8qqoKLYHv6BodHUVnH0mS9fX1OTk5aC7K0fS5gNmHyG8Qkslk1AV1fHz84OCg3y4SiWThwoXodXJyssPhIAgiJiYmNzc3MzNz7dq18fHx6enpL7/8MjWsyWRCry9cuJCRkUFdO9OLCxYs0Gg0JpMpJSXF6XQeOnRIo9E8fvzYaDSuX78+NDQU32DhwoX47vQl3L171+VyJSQkoKLP5xOJRMPDw4ODg8uXL2est7+/f2xsLDExkVoyOtXp3/gGBgYwRvj999/Lyso6OjrGxsZ8Pp/P58NYEi+S7TW1Wo28hnEBBeca+RaIJoqOjqYmioqKCg8Pp9xK/aTMcCvnujCz4O3Ahq89Q4ZA8Xzekclk9E2e/v5+giDo8+JFYtwnZC18JybeVrm5uXv37t2yZQtjFox4lUrFVpWSkqLVaru6uigD8h1d4eHh2dnZTU1N77333vnz5wsKCvr7+30+H93RWDsBMxv/MWYK+f77769du9be3u50OktKSl544YWvvvqKIIg5c+YsWLAAtcHfUZadnW00Gru6urRabXR0dFpaWmtrK32nC9/Ab3cKj8cTEhJy9epV6rQPCfn/vuKcOXMErtdisQg0gk6nKywsbGhokEgkPT09WVlZQsbHiOSDzwUMhK9RIEFyK9fEZEzMO36ZgPsmSW9vr9Vq/fXXX8fVi/5VCTEwMFBZWVldXb179+7KysolS5ager6jKy8vr66uTq/XX758+fz58263e0qWA8wM8Jc5mMt8gXtlTU1NjKt1hMViUavVjEqv16tQKKiLaEaRJEmTyZSRkZGTk9Pc3EySZH19/Z49e+Li4pxOp5AGfrvTkclk7G0xpVJpsVjYsgXulXEaob+/XyQS0Ss593woS9ItzykS4zX27Ox69hoxu1iYiagiw4986xK4V0a1HxkZCQkJoW8J4u3GliFEPMY79O4ka7upqakJteTTSfK4j46QY4Dk3ydknH1er5d+NmH2yijxJM9eGUmSLpdr7969Mpls586dbOX0o8vj8cjl8tra2tdee42aq7u7G70Le2Wzm4nHGLfbLRKJ7HY7o4iO8tzc3J6envb29rS0tIqKCpIkOzo6srKyLl686HK5HA5HYWGhVqulRkbbuK2trampqVQlo4hQKpVKpRK17+npiYqKSktLE94A/y59N3nnzp2ZmZnoS9nRo0crKytJkqyqqsrIyLBarT09PcXFxa2trahxYWFhTk6Ow+Fob29fsWLFiRMnOO3JZwSlUllfXz80NGS323U6Hf3zgm1JulM4RfJ5DeMC+sI518i5QIEf0ww/8q0LMwtf+4yMjMLCwr6+PrvdvmrVKrzd2DKEiMd4hxFjSJLU6XT0eakROHXyuY/uDiHHAMmKMZy2YjuaMQifeDzd3d16vZ70d4Ln5+dHRUX98MMPqJibm6vT6bq7u9vb25cvXw4xZhYz8RhDkmRFRYVUKm1sbKQXjx8/LpPJjhw5olQq586d+84776DfUcfGxioqKjQajVgsViqVer2+r6+PMUtpaWl5eTk1PqOIyM/Pz83NpYrp6emMNvgGmHcZi/V4PHv37lWr1VKpNDs7G30B9Hq9ZWVlCoVCIpHodDqXy4Uau93uoqIihUKhVqsrKiq8Xi+nPfmM0Nramp6eLpFI4uLiSkpK6J9ibEvSdXKK5PMa3+yM9pxr5FygwI9phh/51oWfhbN9Z2fn2rVrZTJZSkrKiRMn8HbjlOFXPN47DP/29PRs2LBBKpUmJSVVV1dTI3DqFOI+IccA+d8Yw2crzjXSB0HiZTKZRqOhixcI5gQnSbKpqUkmk1Fi+vr6tFqtTCZLSEg4cuQIxJhZjJ8YMwE4zz2BaDSaS5cu8RWfNiZjyaCC4cfxrmuq2j/hw4lvi3K8gwTUVsGAzWZTKpXTrQIIFE/0N3+/3LhxA1MEZihB4scgkQEwsFgsSUlJ060CCBTBmEtmJnL9+vVdu3ZNt4rg5dGjR2+++eY///wz3UKAoODTTz89efLkwMDAb7/9Vl5evnPnzulWBAQKiDFTQ0FBAfVHB4BNaGioWCwuLS2dbiFAULBmzZr6+nq1Wq3X6/fs2bN169bpVgQEjKndepuq7eAp2csOKCjPNHrtcrlCQkLQHTvsH2MJgrBarYzuZ8+exSyQ+u8hQq1W79+/n52JgN5+kmb3eDxvvPEGY5DBwUG9Xi+Xy+Pj48vKypAAzkqKkZGRuLg4m83GFmY2m9E/5AEAeHqA65gJQn+WgdvtlkqlmBS2NTU1jJra2lr8+Cj5m8fjGR0dbW5u/uWXXyorK/kaTzJJ+8OHD7OysrxeL6P+3Xff9fl8VqvVaDS2trai9XJWUpw4cUKv1y9btow9i1wuhz/fAcBTx9SGrKfnOoZ9gyl63dPTs2LFCnozkUgklUrpf/M0mUwSiQR/HcMwY1tbW3Jy8lQu4L/TffbZZ+xbt0UiET2dV0pKCmcl1WVkZCQ1NZX6syH5X2vMxFueAACYJP6vY9jp1jGp4/32JXgypRPjSS2OT/bOSLc+maT0fBMxHm1A16ZSqa5du0avkUgkWq22rq6Oqqmtrc3Pz6evhaGZjUQi8Xg86DXbgPQk7cK9Q7F48eIDBw4wKj0ej8/nE4vFlIDR0VHOSqpLXV1daWkpPV082xoUVEJ4AABmMf5jDGe6db7U8UL68mVKH1dqcUzCc0a69UkmpeeciPFoA782LC0tbWhoQPHp1q1bLS0tu3fvpt5la2YwPDxcUVFBJVXjMyB9QCHewRMdHb1ixYry8vJHjx7du3evoqIiPT2dsxK1v3//fk1NTWVlpUqlOnDgAOYJOoiCgoJ169bxRSAAAGYJ+MsczhRSfKnjSVYGJL9ZvKhM6eNKLY5PeM5Itz6ZpPSYTOl8e2UMqLdWr15dV1dHkmRZWVlRUREj+QddM1Wp+BexWJyfn08lgWcbkCGGzzt42Kvo6OhIS0sTi8VSqZQgiAsXLvBVkiRZXV2NkgJ0dnampqays+kwxne73VVVVXK5PC8vj8pIBADALMNPjHE6nWKxmCra7XbGJxrJnyiTsy9Jkmazef369fHx8QqFQi6Xo75Op1MikVCNOzo68D9XMBqj/wmzPyX5NAjMI8I3ETn+GGMwGJYuXToyMiKXy202GyP5B7uXVCpFAbWxsTEuLo6eEYRtQIwY4b9s8a1iaGiopqaGkdiUXanRaKhgbDAY2IlQOccfHBzU6XT0pJMAAMwmpuG+Mp1Ot3r16tbWVovF0tzc7Lc95jF8M4iNGzeKRKK8vLzMzEzO264YhISEqFQqlUq1detWhULxzTffUG+N14CTRCqV1tbWHjp0CFN59+7drq4u6ukjGo3G6XT6Hfmvv/5COTcxt8wBADCj8ZNLRqlUisXiv//+Gz1QyGazCf+nIWffgYEBp9P50UcfoTbUHbdKpZIgiFu3bqHPKbvdTo3DfgqL1+v1eDz0xosWLZpy/QiBEwmhpKSkqKiIet6zcA4ePFhaWlpUVBQWFsZnwMDR2NioUCg2btyIqZRKpT6fj25nv4batWvXmTNnioqK7Hb7vHnzAiQeAIBpxu+VDjvdOmY3ZmRkRCQS2Ww2lDGXM1U7Z6Z0cjypxQUmPOfTz26J2SvjnIj876MNHA4HfUuNIZWeI/nixYvsKTj3yhiVKSkpDQ0N6DXbgIHbK/N6vUlJSQaDwW+lTqfLysrq7u62Wq0pKSnffvstY6jOzk66Er1e3/3vE0QAAJit+I8x7HTr+E+x/fv3Uwn/OVO1c2ZKJ8eTWlxgwnM+/eyWmBiDyZROPdrA4/FIJBLOH675fuQYb4w5c+ZMQkIC+lM924CBizGnT5+m/90HU+lyufLz8+Vy+aJFi44cOcIe/9y5c8uXLxeiBACAWcMzJElO74XUBLh582Zqauq9e/eCZ6L333+/vb39559/DrSkGcrDhw+Tk5MPHjy4ffv26dYCAMCTI7hy+89cqqur2b8bARRhYWFnzpx58cUXp1sIAABPFIgxU0NoaOjzzz8/3Spw8N2P19XVRf9nfuCAAAMATyEQY54W+C6znkyAAQDg6WRG/h4DAAAAzAggtz8AAAAQKCDGAAAAAIECYgwAAAAQKCDGAAAAAIECYgwAAAAQKCDGAAAAAIECYgwAAAAQKCDGAAAAAIECYgwAAAAQKCDGAAAAAIECYgwAAAAQKCDGAAAAAIECYgwAAAAQKCDGAAAAAIECYgwAAAAQKP4HqcLBqymPHiYAAAAASUVORK5CYII=)

HTTP POST data:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAAA3CAIAAABVZQ1/AAAACXBIWXMAAA7EAAAOxAGVKw4bAAASQUlEQVR4nO2dfUxT1xvH77CUUgpILRVpVUBXCSGOGEZwc86ocYRVUjfEjXUTJ8GXMGcIMofOMbahUWTMEUKWuaAxm1mMIc1CmOnMQkjnfOlqR1htGMOKhUFFwIoVa+/vj/Pbzd19Ob28VAo+n796Ts/L9zzPvX16T2+f+wxJkgQAAAAABICQ6RYAAAAAzFogxgAAAACBAmIMAAAAECggxgAAAACBAmIMAAAAECggxgAAAACBInhjTGJi4vXr1/mKwAwlSPwYJDIAYNYTpDHmjz/+8Pl8zz33HGcRmKEEiR+DRAYAPA34iTE3b96MjIzkfGt4ePjw4cN8xUliMBhycnL4ik85GKcEOUHixyCRMRkmcAzcvXt327ZtsbGxKpXqgw8+ePToEWaQmzdvxsTETIVS4Gln4tcxQ0NDVVVVfMVJAjEGw+LFi10u13SrmAhB4scgkfGEKSgoGBsbs1gsFy9eNJlMhw4dmrkHEjCDCMa9st7eXrvdvmbNGs4iQBBEWFjYdEsYN0HixyCR8YR58OCB2Wz++uuvVSrVsmXLampqzp07R8zMAwmYWQiKMV9++WViYuK8efPefvvt4eFhgiCGh4cTEhLcbvczzzxz6tQperGmpiYyMvLYsWPz58+PiYnZunXrgwcP0DhXrlx56aWXIiMjVSrV66+//ueff3JOZzAYNmzYEBoayihu2rTp2LFjqPL69ethYWFIDEEQO3bs2LdvH77Bs88+i+/OkPHw4cPt27dHRkYuXrz4448/fvz4MUEQjx8//vDDD+fPnx8REbF58+Y7d+6gxvfv39+xY0dsbOzChQs/+eQT1JgTTiNcuXJl5cqV4eHhsbGxmzdvvn37NvHvfgjbkvQtDk6RqMHx48cTExNjYmLeeustaqVCXMC5Rs4F0ieKiIjYsmXLnTt39u3bFxsbO2/evG3btt2/f5/tVr514WfB24Ggbe9gxmfLECIe453Dhw/HxsYuWLDg5MmTBEHcvn37lVdeiYiIWLJkyRdffEHXw9bJ5z46+LWwT0y+9uHh4bdu3YqIiEAdOzs74+PjGcKQ+MjIyGXLln333XecRy8nP/30E2Uo9tG1ZcuWzz//nGq8cuXKU6dO9fb2vvrqq5GRkYmJicePH4d9uVmM/xjjdrstFovJZLp8+bLT6dy/fz9BENHR0TabTSaTeTwevV5PL27atMntdl++fPnq1atXr141m81Hjx5FQ2m12oKCAofD0dbWtmrVKolEwjkj30aZVqs1Go2o8scff/T5fC0tLahoNBqzs7PxDXQ6Hb47Q0ZlZeXo6KjVam1paWltbW1oaCAI4ujRo0aj0Wg02u32+Pj4jo4O1HjPnj1Op9NsNre0tBgMhvr6ej57chrBbDYXFRX19fW1t7er1eri4mLK+JyWxItEHa1WK/Kaw+EoLy8X7gLONfItEB0ebW1tFovF6XQmJye7XC6r1Xrp0qXu7m5qXoZb+daFmQVvBwaY9gwZQsRjvGOz2drb2xsbG1etWkUQRHFxcVRUlM1mu3DhQmNjI14kxn1C1sJ5Ygqx1Y0bN0pLS6urqxn1SHxHR0dzczM9xsSyoN66cuXKunXrCgoKUJHz6MrLy2tqakINent7LRaLTqcrLi4Wi8WdnZ1Go/H06dN+DQXMYEgs3d3dBEGMjIygoslkSkpKot6SyWT0lqiIujgcDlR//vz59PR0kiQHBwdFIpHH42HP4nA4EhIS0Gu32y2TyQYHB9lFp9MplUrRCBkZGSUlJfn5+WjGqKiosbExfAOHw4HvzlClUCjcbjd6bbFYMjIySJJUKpVms5nR0uv1ymSyrq4uVDQYDJmZmZz2xBiBorOzMy4uDmNJuuU5RTK81tbWhrwmZHbONfItEE00NDRETRQSEjI6OoqKJpNp6dKl6DXdj3zrws+CtwMqzp07F9OeU4YQ8XQY3qEOVKRfIpHQ56X0cOokedxHB7N2zhMTs3ZET09PUlLS2bNnGcL4xKMuDEiStNvteXl5crm8qqoKLYHv6BodHUVnH0mS9fX1OTk5aC7K0fS5gNmHyG8Qkslk1AV1fHz84OCg3y4SiWThwoXodXJyssPhIAgiJiYmNzc3MzNz7dq18fHx6enpL7/8MjWsyWRCry9cuJCRkUFdO9OLCxYs0Gg0JpMpJSXF6XQeOnRIo9E8fvzYaDSuX78+NDQU32DhwoX47vQl3L171+VyJSQkoKLP5xOJRMPDw4ODg8uXL2est7+/f2xsLDExkVoyOtXp3/gGBgYwRvj999/Lyso6OjrGxsZ8Pp/P58NYEi+S7TW1Wo28hnEBBeca+RaIJoqOjqYmioqKCg8Pp9xK/aTMcCvnujCz4O3Ahq89Q4ZA8Xzekclk9E2e/v5+giDo8+JFYtwnZC18JybeVrm5uXv37t2yZQtjFox4lUrFVpWSkqLVaru6uigD8h1d4eHh2dnZTU1N77333vnz5wsKCvr7+30+H93RWDsBMxv/MWYK+f77769du9be3u50OktKSl544YWvvvqKIIg5c+YsWLAAtcHfUZadnW00Gru6urRabXR0dFpaWmtrK32nC9/Ab3cKj8cTEhJy9epV6rQPCfn/vuKcOXMErtdisQg0gk6nKywsbGhokEgkPT09WVlZQsbHiOSDzwUMhK9RIEFyK9fEZEzMO36ZgPsmSW9vr9Vq/fXXX8fVi/5VCTEwMFBZWVldXb179+7KysolS5ager6jKy8vr66uTq/XX758+fz58263e0qWA8wM8Jc5mMt8gXtlTU1NjKt1hMViUavVjEqv16tQKKiLaEaRJEmTyZSRkZGTk9Pc3EySZH19/Z49e+Li4pxOp5AGfrvTkclk7G0xpVJpsVjYsgXulXEaob+/XyQS0Ss593woS9ItzykS4zX27Ox69hoxu1iYiagiw4986xK4V0a1HxkZCQkJoW8J4u3GliFEPMY79O4ka7upqakJteTTSfK4j46QY4Dk3ydknH1er5d+NmH2yijxJM9eGUmSLpdr7969Mpls586dbOX0o8vj8cjl8tra2tdee42aq7u7G70Le2Wzm4nHGLfbLRKJ7HY7o4iO8tzc3J6envb29rS0tIqKCpIkOzo6srKyLl686HK5HA5HYWGhVqulRkbbuK2trampqVQlo4hQKpVKpRK17+npiYqKSktLE94A/y59N3nnzp2ZmZnoS9nRo0crKytJkqyqqsrIyLBarT09PcXFxa2trahxYWFhTk6Ow+Fob29fsWLFiRMnOO3JZwSlUllfXz80NGS323U6Hf3zgm1JulM4RfJ5DeMC+sI518i5QIEf0ww/8q0LMwtf+4yMjMLCwr6+PrvdvmrVKrzd2DKEiMd4hxFjSJLU6XT0eakROHXyuY/uDiHHAMmKMZy2YjuaMQifeDzd3d16vZ70d4Ln5+dHRUX98MMPqJibm6vT6bq7u9vb25cvXw4xZhYz8RhDkmRFRYVUKm1sbKQXjx8/LpPJjhw5olQq586d+84776DfUcfGxioqKjQajVgsViqVer2+r6+PMUtpaWl5eTk1PqOIyM/Pz83NpYrp6emMNvgGmHcZi/V4PHv37lWr1VKpNDs7G30B9Hq9ZWVlCoVCIpHodDqXy4Uau93uoqIihUKhVqsrKiq8Xi+nPfmM0Nramp6eLpFI4uLiSkpK6J9ibEvSdXKK5PMa3+yM9pxr5FygwI9phh/51oWfhbN9Z2fn2rVrZTJZSkrKiRMn8HbjlOFXPN47DP/29PRs2LBBKpUmJSVVV1dTI3DqFOI+IccA+d8Yw2crzjXSB0HiZTKZRqOhixcI5gQnSbKpqUkmk1Fi+vr6tFqtTCZLSEg4cuQIxJhZjJ8YMwE4zz2BaDSaS5cu8RWfNiZjyaCC4cfxrmuq2j/hw4lvi3K8gwTUVsGAzWZTKpXTrQIIFE/0N3+/3LhxA1MEZihB4scgkQEwsFgsSUlJ060CCBTBmEtmJnL9+vVdu3ZNt4rg5dGjR2+++eY///wz3UKAoODTTz89efLkwMDAb7/9Vl5evnPnzulWBAQKiDFTQ0FBAfVHB4BNaGioWCwuLS2dbiFAULBmzZr6+nq1Wq3X6/fs2bN169bpVgQEjKndepuq7eAp2csOKCjPNHrtcrlCQkLQHTvsH2MJgrBarYzuZ8+exSyQ+u8hQq1W79+/n52JgN5+kmb3eDxvvPEGY5DBwUG9Xi+Xy+Pj48vKypAAzkqKkZGRuLg4m83GFmY2m9E/5AEAeHqA65gJQn+WgdvtlkqlmBS2NTU1jJra2lr8+Cj5m8fjGR0dbW5u/uWXXyorK/kaTzJJ+8OHD7OysrxeL6P+3Xff9fl8VqvVaDS2trai9XJWUpw4cUKv1y9btow9i1wuhz/fAcBTx9SGrKfnOoZ9gyl63dPTs2LFCnozkUgklUrpf/M0mUwSiQR/HcMwY1tbW3Jy8lQu4L/TffbZZ+xbt0UiET2dV0pKCmcl1WVkZCQ1NZX6syH5X2vMxFueAACYJP6vY9jp1jGp4/32JXgypRPjSS2OT/bOSLc+maT0fBMxHm1A16ZSqa5du0avkUgkWq22rq6Oqqmtrc3Pz6evhaGZjUQi8Xg86DXbgPQk7cK9Q7F48eIDBw4wKj0ej8/nE4vFlIDR0VHOSqpLXV1daWkpPV082xoUVEJ4AABmMf5jDGe6db7U8UL68mVKH1dqcUzCc0a69UkmpeeciPFoA782LC0tbWhoQPHp1q1bLS0tu3fvpt5la2YwPDxcUVFBJVXjMyB9QCHewRMdHb1ixYry8vJHjx7du3evoqIiPT2dsxK1v3//fk1NTWVlpUqlOnDgAOYJOoiCgoJ169bxRSAAAGYJ+MsczhRSfKnjSVYGJL9ZvKhM6eNKLY5PeM5Itz6ZpPSYTOl8e2UMqLdWr15dV1dHkmRZWVlRUREj+QddM1Wp+BexWJyfn08lgWcbkCGGzzt42Kvo6OhIS0sTi8VSqZQgiAsXLvBVkiRZXV2NkgJ0dnampqays+kwxne73VVVVXK5PC8vj8pIBADALMNPjHE6nWKxmCra7XbGJxrJnyiTsy9Jkmazef369fHx8QqFQi6Xo75Op1MikVCNOzo68D9XMBqj/wmzPyX5NAjMI8I3ETn+GGMwGJYuXToyMiKXy202GyP5B7uXVCpFAbWxsTEuLo6eEYRtQIwY4b9s8a1iaGiopqaGkdiUXanRaKhgbDAY2IlQOccfHBzU6XT0pJMAAMwmpuG+Mp1Ot3r16tbWVovF0tzc7Lc95jF8M4iNGzeKRKK8vLzMzEzO264YhISEqFQqlUq1detWhULxzTffUG+N14CTRCqV1tbWHjp0CFN59+7drq4u6ukjGo3G6XT6Hfmvv/5COTcxt8wBADCj8ZNLRqlUisXiv//+Gz1QyGazCf+nIWffgYEBp9P50UcfoTbUHbdKpZIgiFu3bqHPKbvdTo3DfgqL1+v1eDz0xosWLZpy/QiBEwmhpKSkqKiIet6zcA4ePFhaWlpUVBQWFsZnwMDR2NioUCg2btyIqZRKpT6fj25nv4batWvXmTNnioqK7Hb7vHnzAiQeAIBpxu+VDjvdOmY3ZmRkRCQS2Ww2lDGXM1U7Z6Z0cjypxQUmPOfTz26J2SvjnIj876MNHA4HfUuNIZWeI/nixYvsKTj3yhiVKSkpDQ0N6DXbgIHbK/N6vUlJSQaDwW+lTqfLysrq7u62Wq0pKSnffvstY6jOzk66Er1e3/3vE0QAAJit+I8x7HTr+E+x/fv3Uwn/OVO1c2ZKJ8eTWlxgwnM+/eyWmBiDyZROPdrA4/FIJBLOH675fuQYb4w5c+ZMQkIC+lM924CBizGnT5+m/90HU+lyufLz8+Vy+aJFi44cOcIe/9y5c8uXLxeiBACAWcMzJElO74XUBLh582Zqauq9e/eCZ6L333+/vb39559/DrSkGcrDhw+Tk5MPHjy4ffv26dYCAMCTI7hy+89cqqur2b8bARRhYWFnzpx58cUXp1sIAABPFIgxU0NoaOjzzz8/3Spw8N2P19XVRf9nfuCAAAMATyEQY54W+C6znkyAAQDg6WRG/h4DAAAAzAggtz8AAAAQKCDGAAAAAIECYgwAAAAQKCDGAAAAAIECYgwAAAAQKCDGAAAAAIECYgwAAAAQKCDGAAAAAIECYgwAAAAQKCDGAAAAAIECYgwAAAAQKCDGAAAAAIECYgwAAAAQKCDGAAAAAIECYgwAAAAQKP4HqcLBqymPHiYAAAAASUVORK5CYII=)

Research’s Comment:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAAA3CAIAAABVZQ1/AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAQFElEQVR4nO2dbUxb1R/H7ypjhZVnKA/rBLaIy7IgUdIww+ZcFrdUQioDNIiyRDLMgmQSXTamiFM3ZC5RRLIXara90MUoaQhZiKkPwYUsbLJKKiIhbNSuVAQE7GrXAPf/4vy9ud57zrn3lt624O/zqj09Pef3dDm9p+V71rEsywAAAACACmjCbQAAAACwZoE1BgAAAFALWGMAAAAAtYA1BgAAAFALWGMAAAAAtYA1BgAAAFALWGMAAAAAtYA1BgAAAFAL6TVmYmIiLi4uBKaohyIXBJ3n5+fPnDmzwrlCGcOXX345Jibm4sWLagw+MTGRlJSkxsgBEJqokmbht5MeKy2eUMK3LeiRXAN/NIBgAfcxQrKzs6enp7mnc3Nzp0+fDqM9ipiZmWlvb7927Vp1dXW4bVnjCOoE2x7JxRPJtgFriahwGxCJbNiwIdwmBIjH44mNjX3ooYfCbch/AlKdrN76AYCgo+A+Bt3/njt3Ljc3Nykp6dlnn52fnxf0+eijj/bv3889PXnyZE1Nzd27d+vq6tLS0jZv3vzmm28uLS0xortpbhMGtZ85cyYtLS0zM/OTTz7hj//UU0+dPXsWPf7pp582bNjA2VBXV/fqq6/eu3fvhRdeiIuLy87OfuONN9BciHfffTc9PT0pKammpubvv/9GjdevX9+1a1dcXNymTZsOHjz4yy+/CPY6cnJyPB7PunXr0O4TZXxJPvjgg9zc3JSUlOeee44z+/r16zt37oyJiUlLS6uoqLhz5w7DME8//fQ777zDvXHnzp0XL16UnHpmZoZvbQBhxyb3zp07+/fvj4uLe/DBBz/77DOxX7du3dq4cePNmzeRDUlJSd999x02tqRGDqzjJJv50ItTHDpsmWFzgRAXj+QemqB4sJeG+O2IpaWlEydOpKenb9y4saKiYmZmBrWLc4qmO3v2rMA8+nTiwmYI9YmNnsBaUtywVxy2LLF5lzM1EPko2yvzeDxDQ0P9/f0DAwMOh6OpqUnQwWw29/X1/fXXX+hpd3d3WVlZQ0ODy+UaHBzs7e3t7u7u7OyUnGVkZMRut1+4cKG4uJj/UklJidVqRY97enqWl5d7e3vRU6vVajKZTp065fV6h4aGent7+/r6zp8/z4154x8GBwfb2tq4AQ8dOuRwOK5evVpcXKzVavnTJSQkjIyM6HQ6n8+Hdp9I48sJnc1mQ6FzuVzHjx9H7YODg4cPH3a73Xa73WAw1NfXMwxTWVlpsVhQh8nJSZvNZjabJadOSUnhWxtA2LHJra+vj4+PHx4evnLlCnaNyc3NbWpqOnr0KMMwzc3NJpPp8ccfJ8WWHnCs4/IjTCpObOjEZYbNBUMuHjqC4sFeGqT3trW1Wa1Wq9U6OjqalZU1PDyM2rE59Xg8AwMDAvPo04kLm1SfpOjxwcaNFDSsC6S8B3y5AREEK8Xt27d1Oh16wDDMwsICar969eqWLVvE/YuKir788kvujV6vV6fTjY+Po1e7u7uLior4w3KzJCYmcrPMzs5ijXG5XLGxsT6fj2VZo9HY2NhYVVWF3hUfH+/3+1NTUz0eD+pss9mMRiM3psPhQO1dXV2FhYUsy87OzkZFRaHRxP5in2LHp7yda+SHrr+/Hxu6sbGxjIwMlmW9Xm98fDwyuLOzs7S0VM7U/NkXFxcDCLs4uYuLi1qtlh861F+A3+/ftm1bS0tLamqq2+1mCbHFNvLBOk6xmWunF6c4dPQyY3m5IBWPYHbJx6zo0qDEQa/XDw4OChqxOSWZJzkdJXqC+pRTeIK4kawilSU270qnBiITZd/H6HQ6bn/AYDDMzs6K+5jN5p6enoMHD/b09JhMprm5Ob/fn5ubi17dtm0bqj/6LKQfL2VmZubl5fX392/fvt3lcjU3N+fl5S0tLVmt1n379nk8nunp6ZycHNR5eXk5Kur/Dmq12s2bN3M2OBwOhmGSkpLKy8uLior27t2blZVVWFj42GOPUQz7888/SeNLwg9dVlYWF7qbN28eO3ZseHjY7/cvLy8vLy8zDBMTE2MymSwWy0svvdTV1XXo0CGlU09NTQUQdnFyp6amGIbhhw773vXr13d0dOzbt6+9vT09PZ0hxFYy4GLH6TZL2s+QsyYuM2wuGELxBIDg0iB9bTM/Pz87O5ufny9oJ+WUZJ7M6RCk+pRTeNi4Ya0iuYDN+0ouNyByCH7OysrK0M5DT0+Por8RMjGZTFardXx8vKSkJCEhoaCgoK+vD22U+Xw+jUZz48YNrhY1GonNwM8///zHH3+02+0ul6uxsfHRRx995ZVXSJ0DGF8Ss9lcW1t7/vx5rVbrdDoPHDiA2isrKzs6OqqrqwcGBrq6ujweT9CnDi5ut1uj0bjdbq5FHNsPP/wQ28gfR+D4yg3DZs3v94t7knIRLBRdGvfdd18opyMhp+aDEjdx3tW43IAwIHmnw98rw25ZiNmxY4fVak1MTFxYWCDdHS8sLGg0Gv7mhngDBEt/f7/RaCwtLb1y5QrLsp2dnQ0NDRkZGS6Xi2VZnU4n3mQQ3LlbLBZuP4GPzWYzGAz0vTLs+IK5sHtl2NBNTU1FRUXxDeBC6vP5kpOT33///bKyMplTszL2ymSGnbNQsFdmsViwSZ+bm8vIyLh8+XJycvLw8LC4A4qtnEax43JsphenOHTiNJFyQSqeAPbK2H9fGuIocej1epvNJmiUs1cmqG3KdCuJHh9s3EhWkcqSxeVdcmpgVaDKGtPc3Jyfn19SUoKe1tbWlpaWOhwOu93+8MMPt7e3o3aj0VhbW+t2u0dHR4uLi2WuMSzL6vV6vV6P9pedTmd8fHxBQQF66cUXXywqKkIfk9va2k6dOsX+82eivLzc6XTa7faCgoKWlhaWZYeHhw8cOPDtt99OT087HI7a2tqSkhKBAR6PJyoqanR0lDI+NlyURn7o9Hp9Z2fn3Nzc6Oio2Wzmh7Sqqio+Pv6LL76QObVgopWEnW+h2Wzmhw6b9CNHjlRWVrIs+/bbb+/Zs4cUW2yjeDSB4ySbFxYWoqKiRkZGFhcX6cUpDh02TdhckIqHPwLJEkHxsKJLg8Tp06eNRuPQ0JDT6ayvr+/r60Pt4pySzJOcjm+b0uhJxo1iFaksWVze5dQ8EOGossbYbDaGYS5cuICeejyew4cPp6amGgyGlpaWxcVF1D42NrZ3716dTrd9+/b29nb5a0xVVVV5eTn3tLCwsKmpCT32+XxHjx41GAyxsbEmkwl9YkJjtrW16fX6xMTE559/3uv1sizr9/tbWlry8vKio6P1en11dbXb7RYb0NLSEhsbi9zBjo8NF6WRH7q+vr7CwkKtVpuRkdHY2MgPqcViQT+aoLhGmWglYedb6HQ6n3jiCZ1Ol5eX995774mTfuPGDZ1Ohz60+ny+nJycS5cuYWOLbRR7IXCcZDPLssePH0epoRenOHTYNGFzQSoewQgkS/jFw4ouDVK1Ly4uHjt2LDU1VavVms3m6elpUk7RCK2trQLzsNMJ4GxTGj3JuJGChnWBG0ecdzk1D0Q461iWDfr+2927d1NTU10uV+TojgBAJCC4NCYmJnbs2MH9wjgA6CPAlQiEHVW+Q/v666+Li4uhrAFAgPjS4H43FZrpACDEBH+NmZ+f7+joqKysDPrIALCqEV8aOp2O+9/DEEwHAKEn+GsMtwMb9JEBYFUjvjRSUlK2bt0asukAIPRIrDEk0XJK/+jo6K+++kolWcDwasuvFtl2BsTVycjR5F8JlMK4d+9e0C+N7Oxs0pcxakwHAEpRcB9DEjP/77BaZNsBCmqXMRQGAPBRtlcGn4kgAmsASCIAhAzF2v6MPJF/hmF+/vnnlJSUH374QdCOVQJfibY8o0TznCEIhstxiiTbLtMYyYgpiowcrXiSIr1A0x4rty55jAJDEOqnhBd7ZAPJEUVnE/ChW15XV6doT2xycvLJJ5+Mi4vLzc09d+4cNx3WTVJhUKqR4qa4P/1oBuz4ABBeAvzOX1Lkf35+vqysrLW1ddeuXYKXKArqgWnLM0o0zxmyYLikUxxiaXQ5xkgOrigyklrxJHF1saY91mDJYxQYglA/JbzYIxtIjig9m4CDbjk6d0A+9fX10dHRY2NjVqv10qVLXDvWTUphkKqR5CapPwml/QEgRND/RRMrakTRUef6mEymI0eOSP4LqEBBPTBteaWa5xT9f/rJBXQpKkljJI9FUBQZlireTlGkZ/6taU+SkJI8RoEk1E8JL0lLX+yI0rMJ+NAtHxsbk6ktxv5TfpwZ/PIjyc6ThB6w6aC4SUof5WgGbLUDQHgJUHeZLvJ/8uTJ3t7ejz/+GPtekoJ6wNryijTPKYLhck4ukIRkjJzBFUWGkRJvJ0m+CzTtSQbTj1FYv349VqifHl7SbwLFjkxOTio9m4CDbrkiffipqanl5WW+GehBALLzirTuSf2Vjg8AYSf42v5er7erq+vy5cv19fVlZWUJCQmCDmorqNOJZMFwpZEJ4zEKqINYqL+pqSmA8AbdEUnLV0gkVxEARBTBvzA0Gk1XV1dFRYXRaHzttdcEr/7xxx8ul+v111/funXrpk2bBEftitHr9QzD/Pbbb+jp6Ogotk90dPStW7fQ05GREfQB0+fz8d94//33MwyTmZkZGxs7Ozu76R8yMzMDdla+MZIojQzDMA888IBer//mm2+uXbsm/uuJdV+RweiLje7u7tLSUoZhzGazxWL5/vvv+XM98sgjNTU1J06c+PTTTy0WS2DhFTtCsio5Odnr9XJf3jidTuyAciyXg16v12g0ExMTnBnoQQBuYtNBCT62P8V9mekGgFBD30rDipZT9sT5L42MjGi12qGhIcGYJAX1lWjLK9I8J+n/S27002Xb6cbIkaxWGhmWLN4uR5GeYjDfJNIxCiShfjnhFSN2RNHZBNhgYi0nafLzH/PHKS8vN5vNt2/fttvt+fn53HQk2XlsYSjVuqf0Jx3NQOpPOdEZAEKAtLa/WLRc5hrDsmxDQ8Pu3bsFA1IU1LFjSmrLswo1zyn6/1gD+I0U2XZJY+iDBxAZlizeLlORnmQw9xLlGAWSUL+c8IoRO6LobAIxJMtJmvyCxxxut7ukpESn0+Xk5LS2tvIPkSPJzosLg1KNWDcp/SlHM4j7yzkpAwBURRVt/0hg5arpq4I1I96+Khz59ddfd+/e/fvvvyt9o9JqVLs/AIQM+KJydbNmxNtXhSM2m23Lli3htgIAVhPB/10ZEDKQePszzzwTbkNWSiQ78tZbb2VlZZWWlo6Pjzc1NTU3N4fbIgBYTcB9zCpmzYi3R7Ije/bs6ezsNBgM1dXVDQ0NYsEeAAAorNnvYwAAAICwA/cxAAAAgFrAGgMAAACoBawxAAAAgFrAGgMAAACoBawxAAAAgFrAGgMAAACoBawxAAAAgFrAGgMAAACoBawxAAAAgFrAGgMAAACoBawxAAAAgFrAGgMAAACoBawxAAAAgFrAGgMAAACoBawxAAAAgFr8D4BKYtX1isfBAAAAAElFTkSuQmCC)

Screenshot: eco-sapiens.com vulnerability

Mirror: Click here to view the mirror

Coordinated Disclosure Timeline

Vulnerability Reported:	31 October, 2019 17:31 GMT
Vulnerability Verified:	31 October, 2019 17:37 GMT
Website Operator Notified via Bug Bounty:	31 October, 2019 17:37 GMT
Public Report Published
[without any technical details]:	31 October, 2019 17:37 GMT
—	—
Vulnerability Fixed:	17 December, 2019 05:14 GMT
—	—
Public Disclosure: A security researcher can delete the report before public disclosure, afterwards the report cannot be deleted or modified anymore. The researcher can also postpone public disclosure date as long as reasonably required to remediate the vulnerability.	30 November, 2019 17:31 GMT
—	—

JSON