Lucene search

K
openbugbountyFoulenzerOBB:1068351
HistoryJan 15, 2020 - 11:05 p.m.

portal.lanis-system.de Cross Site Scripting vulnerability

2020-01-1523:05:00
foulenzer
www.openbugbounty.org
36

Open Bug Bounty ID: OBB-1068351

Security Researcher foulenzer Helped patch 132 vulnerabilities
Received 3 Coordinated Disclosure badges
Received 1 recommendations , a holder of 3 badges for responsible and coordinated disclosure, found a security vulnerability affectingportal.lanis-system.de
website and its users.

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:

&nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence;
&nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence.

Affected Website: portal.lanis-system.de
Open Bug Bounty Program: Create your bounty program now. It’s open and free.
Vulnerable Application: Custom Code
Vulnerability Type: XSS (Cross Site Scripting) / CWE-79
CVSSv3 Score: 6.1 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N]
Disclosure Standard: Coordinated Disclosure based on ISO 29147 guidelines
Discovered and Reported by: **foulenzer Helped patch 132 vulnerabilities
Received 3 Coordinated Disclosure badges
Received 1 recommendations **
Remediation Guide: OWASP XSS Prevention Cheat Sheet
Export Vulnerability Data: Bugzilla Vulnerability Data
JIRA Vulnerability Data [ Configuration ]
Mantis Vulnerability Data
Splunk Vulnerability Data
XML Vulnerability Data [ XSD ]

Vulnerable URL:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAAA3CAIAAABVZQ1/AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAPjElEQVR4nO3dbUxT1/8A8GsBKXjLczse6gTigBiCnSGkGobEGCSsYRWZGIaKG0GzMEaIOsMWxmRTBkKUKTEmS9xeOLMQ1hBCiGmIYV3nOsYKqwwJI1BLIch4smIHpff/4sT7v7/71MtD5cHv55Xncs6555zvORzuKVy3EASBAQAAAG4gWusGAAAA2LRgjwEAAOAusMcAAABwF9hjAAAAuAvsMQAAANwF9hgAAADusn73mKioqO7ubq4k2IggiAC8atbpHvPXX385nc7du3ezJsFGBEEE4BXkYo8ZHh6WSCSsX5qZmbl8+TJXcoWam5szMzO5kivhsp1cXeYZCiFWWHx5VjcoXIaHhwMDA11mI4P4Eobi5XTcTWjjs1Z9WV6YpqamTp06JZVKIyIiPvnkk4WFBXe0bRmGh4e3vODh4REVFVVZWbm4uHj8+PGPP/6YzPbzzz97eXnNzMyQV/bv33/t2rW1aPImsfznmOnp6UuXLnElV8h9e8zqtlO4HTt2TExMvOSbrlVnWa1iEF1aVx1foY3Vl/z8/Pn5eaPR2N7ertfry8vL17pF/w/HcbvdbrfbbTabRqNpaWm5dOlSSkqKTqcj82i1WofD0d7ejpILCwsGgyE1NXVtWrwprMezstHR0f7+fjKutOTG5e3tvdZNWDObJoiAx/Pnz7u6um7duhUREREbG1tXV9fY2LjWjfof3t7e3t7ePj4+u3fvrquru3v3bmpqak9Pz9OnT1EGrVabkJBA7jEGg0EsFsMB70oI2mOuXbsWFRUVHBx8/Phx9BQ5MzMTGRlps9m2bNny3XffUZN1dXUSiaSmpua1114LDAw8efLk8+fPUT2///77W2+9JZFIIiIijhw58vfff7Perrm5OS0tzcvLi5ZED++sNT979uz06dNSqXT79u1ffPHF4uIi9uJh//Lly1KpNCws7Ntvv6U1GzVp7969Pj4+Uqn03XffHRkZET52zLLojrW1tVFRUYGBge+99x750E09eRA4Dqw5b9y4cejQITLDp59+evLkSdaczM7+999/H3zwgUQi2bFjx+eff04dJdTmbdu25eTk/Pvvv+fOnZNKpcHBwadOnXr27BmzYSMjI4cOHZJIJLGxsXfu3CGvs96CGVMMw77++mtmHJnFBQ4pRjmyY3Z8y//iHwrqhMnJyfnqq6/IW+zdu9flSFKLHz58uKamBpXt7u729vYmG3/69Olz5865nH60vnB1mWeURkdH3377bYlEEhUVVVtbyzzV5FlWGNva5yni4+Pz+PHjbdu2oWwDAwPh4eHYUlYZVwcxjlUjMBCs9xKLxQ6H44033pDJZHq9HsOwp0+fdnV1ffnll1qtFuXR6XQpKSlcda7igtrEXO8xNpvNaDTq9XqDwWC1Wi9cuIBhmL+/f19fH3r2zMvLoyYPHz5ss9kMBkNnZ2dnZ2dXV1d1dTWqSqVS5efnm81mnU6XnJwsFotZ78hzUMZVc3FxsdVq7erqamtra25ubmhoIPP39fWZTKbbt28nJyfTmo1hWFdXV2Fh4djYmMlkksvlRUVFwseOtazNZuvp6UHDZTaby8rKmAUFjgNrTrVa3dHRQf7Y1dzcnJWVxZqT2dmLFy/Ozc319PS0tbV1dHTcvHmTHCWj0ajT6YxGo9VqjYuLm5iY6OnpefDgwdDQEGsXioqK/Pz8ent7W1tbqXsM1y1oMbXZbJ0vUOPIWlzIkFIxO25/4fz588eOHeMfCuqEOXr0qEajQV8aHR01Go1qtVp4cZVKRX63amlpcTqdbW1tKKnVajMyMlxOP2ZfuHCNUlFR0datWwcGBrRa7ffff89VlnVZsa59/iKkR48enT179sqVKxjHSpEy8PQO41g1AgPBrO3JkyefffYZimZqaio6Lrt//75CoUhPT7dYLGgj1Ol05MM3s85VXFCbGcFraGgIw7DZ2VmU1Ov10dHR5JdwHKfmRElUxGw2o+tNTU2JiYkEQUxOTnp6etrtduZdzGZzZGQk+rfNZsNxfHJykpnkqtnhcOA4Pjg4iK43NzcrlUoyP1kVa7OpBgYGQkNDuTLwFKSWpQ6XTqdjDhfPONBw5VQqlY2NjWSddrudKyetzSEhITabDf3baDQmJSURL0ZpenqabLNIJJqbm0NJvV6/c+dOWrUOh0MsFlMDERAQwHMLWky54shaXMiQkkmyGazBMplMr7/++sTEBP9QUCfM3Nycn58fampDQ0NmZqbLkaQWt1qtvr6+KC5JSUmlpaW5ubkop5+f3/z8PLV5aAqx9otMcnWZa5RQpMilQY0UtRLWcPCvfa4IIhaLJTo6+u7duwQD2U0LA08HuWa4wECQF0NCQkJCQoKCgsRi8ZkzZ1CFt27dSk1NJQiipKSkvLycIAiVSnX79m2CIIKCgjo7O7nqXK0Ftbl5utyEcBwnn17Dw8MnJyddFhGLxdu3b0f/jouLM5vNGIYFBgZmZ2crlcoDBw6Eh4cnJibu37+frBY9q2IYdu/evaSkJPIBmZZkrXl8fHx+fj4qKoq8jsKMGs//K09//vnn+fPne3t75+fnnU6n0+l02Tv+stThksvlzOHiGgfqz3FPnjzhyalWq1taWo4cOdLS0pKRkYGOmLnGljQ1NTUxMREZGYmSTqfT09OTHCV/f3+yzX5+fj4+PigZHh7O/FWF8fFxDMOogeC/BS2IGEccuYq7HFKBCgsL6+vrg4OD+YeC2k4fH5+MjAyNRvPRRx81NTXl5+fztJNZPCwsLCYmRq/X79q1y2q1lpeXx8TELC4uarXagwcPenl5rWT60bCO0vj4uNPppC4N1rKs4cB41z5XESQ7O7ukpCQnJwclWbsZEREhvHesa0F4IBBfX1+j0YhhmEgkkslkHh4e6HpKSkpJScnCwoJWq0VHIGlpaVqtds+ePQ6HQ6FQsNa5igtqc3O9x6yiH3744Y8//jCZTFartbS0dN++fd988w2GYR4eHmFhYSiP+36jjJVarS4oKLh586ZYLLZYLOnp6S+hLOs4oNkvJGdWVhZ6VG9paUHf9bhyUquy2+0ikaizs5NcCSLRKv/GB9ctBAaRtfj8/PyqtO3GjRvR0dHvvPMOTztZHT169Pr163l5eQaDoampaanFMzIytFrt4OCgSqXy9/dXKBQdHR3ooAxb2fRbt0ZHR3t6en799VfyCms3mYdj6EcrLswZXlZWtqQpLRKJWDe22NjYgICA1tZWs9msVCoxDDt48GBVVdW+ffuSk5PJrYjmJSyoTYL/MUf4cQTXWZlGo6E9RyNGo1Eul9MuOhyOkJAQ8tGeluSqmeesjHlgQr04Pj7u6elJbVJAQIDAszIhZV2e3nCNAytqzvj4eK1WGxAQQB5lsOak3RTH8a6uLv5+UdvMTCK0szKNRkPmYd6CFkSCd4Ywi/M0b3Z2ViQSUQ+IuEbbYrHExcVRDzqEDAVit9uDgoKuXr2alZW1jOJ6vT4pKSkzM7O1tZUgiIaGhuLi4tDQUKvVyjqFWLtMJrm6zDVKKFJDQ0PoupCzMjIc/JOZZ407HA5quLm6yXpWxhNTKnKGCw8E/1n3sWPHFAqFSqUir8jlcoVCUV1dzVN8tRbU5rb8PcZms3l6evb399OSaP5lZ2dbLBaTyaRQKCoqKgiC6O3tTU9Pb29vn5iYMJvNBQUF1Iiig9GOjo74+HjyIi3JVTNBEAUFBZmZmWaz2WQy7dmzp76+ntl41mbLZLKGhobp6en+/n61Wo2+a3t6evb19TkcDmrbmNeZZYXsMfzjQMWTs7y8PCEhgUxy5aR19syZM0qlEv0kWF1dffHiRf4Q05LU03C1Wk0NBJmHeQtaEPnjyCzO37ykpKSCgoKxsbH+/v7k5GSuyZmVldXY2Eh+8i9wKEi5ubl+fn4//vgjeWVJxWUymUwmQ/e1WCx+fn4KhYL8Em0KEYyZRusLa5d5Rik7O1utVg8NDZlMpoSEBGY0ucLhco9hjSCtcp5ucmHtINcMFx4I/j0GfVyPvm8g6ITAYDDwFF/hgnpFLH+PIQiioqLC19cXfThGJmtra3Ecr6qqkslkAQEBJ06cQJ93zc/PV1RUxMTEbN26VSaT5eXljY2N0e5y9uzZsrIysn5aEmVj1kwQhM1mKywsDAkJkcvlFRUVaHFyzSpqszs6OhITE8VicWhoaGlpKerdhQsXyAzUSqjXWcsK2WN4xoGGJyc6WCNbwpOT2lm73V5SUiKXy319fTMyMtAPmwKXBPPJIC0tDcfxmJiYK1euUL9z0W5BCyJZVXV1NTOOzOL8zRsYGDhw4ACO47t27aqvr+eanMxndyFDQdJoNDiOk41cavHc3Nzs7GwymZiYSA4I6/QjGDON2hfWLvOM0tjYmEqlwnE8MjKyqqqKmZ9rWbmczKwrkRkjnm6yYu0g1wwXHgj+Paavrw/DsN7eXvLKnTt3cBwnf6DkesZd9oJ6dbjYY5aBP5b8YmJiHjx4wJVcSc2bjM1mE4vFtN9yWZ9oQQRrqK+vTyaT0S4uY1nBSgTCvdTP/F169OgRTxKQ7t27l5ycLOQtYWsOgrh+GI3G6OjotW4FeLWsrz0GCDEzM3P9+nX0t4QA8KusrAwPD8/MzBwcHCwrK1tXLxADrwL4ZbuNhzwEX+uGgA0gNTW1oaFBLpfn5eUVFxejNw8B8NJsIRifiFINDw/Hx8eTby5xaXh4WKFQTE1NrUbbAAAAbGwunmPW5I30AAAANgfXZ2Wv8hvpAQAArITQ/weT5+XhS3rNu8DXbgMAANgElvCZP8/Lw5f0mneXr90GAACwOQj9zH94eDgyMnJ2dhY91vzyyy8nTpz4559/FhcXcRzv7+9HL2H96aef3n//ffSZv1QqHRoaQv9hUXd3d2Fh4W+//YbqmZyc3BB/2wEAAGAllvD3MVwvD8eW8pp3TMD79gEAAGwO7vobTHjxNQAAgJXuMTKZDMOwx48fo0eZ/v5+dD0sLMzX13dycvLNN99c4S0AAABsUCt9tvDw8EhPTy8tLR0ZGXn48GFFRQX5pby8vA8//PDhw4ejo6M1NTWVlZUrvBcAAICNZRXOr65fvz47OxsXF5eVlZWXl0dev3r1qlKpTE9P37lz5/3796lfAgAA8Cpw8XtlAAAAwLLB5/AAAADcBfYYAAAA7gJ7DAAAAHeBPQYAAIC7wB4DAADAXWCPAQAA4C6wxwAAAHAX2GMAAAC4C+wxAAAA3AX2GAAAAO4CewwAAAB3gT0GAACAu8AeAwAAwF1gjwEAAOAusMcAAABwF9hjAAAAuAvsMQAAANwF9hgAAADuAnsMAAAAd/k/o8JeNdtS5WQAAAAASUVORK5CYII=)

HTTP POST data:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAABLCAIAAAAphcDFAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAbVklEQVR4nO2df0xb1/XAX5lLjeMQMMZJiJMQGlHEGKUpjUhHO5SiiiArsxilJKWUEZZRxChBXUZYljGaORSxKqIIZVE60Spqq6lCCFUVi1iVIRYxknqu5zEHMWo8z2PEEEMcZsDhff+43169vXfv9Q/s8GPn85ff9X3nnnvOvT7vx/W5j/A8zwEAAABABIhaawUAAACATQvEGAAAACBSQIwBAAAAIgXEGAAAACBSQIwBAAAAIgXEGAAAACBSQIwBAAAAIgXEGAAAACBS+Ikxk5OTW7duXWUbc3NzFy5cCPn0O3fuvPLKKwkJCbt27Tp16tTi4iIq/8Mf/vDUU09t2bLl0KFDf/nLX4SnCNUOSxcYLC4uHjt2jNbE5ORkfHw8+vzVV19997vfjY+P3759+w9+8IO5uTlR5SNHjvz617/GJz7y3xw5coTjuLt377766qvIGj/5yU+Wl5dR/du3bx85cmTbtm3bt28/ceIEFk60Hs2kjO5IyxlCiHYQdWffvn3EQr+S7927t3Pnztu3bzOa4zhuZmbm1VdfTUxM3LVr15kzZ7ChaOVS79BcgDh16lRMTMz777/P0EFqNLZMGsQuixQQ1QmwIeH45JhzapWzOHDu3bv3xhtv7N27NyYm5oknnnj77bcfPHhAqxyu2b0aOQH+ED1MldYVD+M+xu12GwyGkE8vLy+Xy+UWi2VwcNBsNp89exaVl5aWNjc3OxyOgoKCyspK4Sl79+51uVyrUjowFhcXCwoKfD5fIJV1Ol1aWprVah0eHna5XDU1NcJvb9++bTQay8vLcYlSqfQK6Ovr4ziusrJyZWXFbDYPDAwMDg5iwxYWFmq1WqvVajQavV5vdXU1Kidaj2ZSWneI5TQhNITdOX/+fGZmJq2QLbmjo6OsrOyJJ55gN1deXr6ysmIymT7//PPr16+3tLSwy4neIbqA47iZmZmOjo7h4eGysjKaAjRj0mQykHZZqoC0TggNMebUKmdx4FRWVtrt9mvXrtnt9q6urv7+fqPR+BDaDRmG0VbDQ/sRizg8E5vNplQq2XX8shohHo9HLpd7PB50ODIysn//fvRZrVY7HA6e5z/99NPMzMxItO4Xm812/vx5RhM2my0uLo7n+enpaZlMhstNJpNWqxXWrKmpOXv2rPBEqUyv1yuTydxuNzocGhpKT09H5RcvXpyfn0flZrMZCSdaj2FSWnek5QwhRKampgoKCvBhenp6T08PsZAteX5+PiMjA/eUhsfjiYqKEhoqNTWVUU70DtutfgcV0ZghjEZil0VypHUCbAiPTwRjTkV0HmEWFhaEI9wv4dJqNXLW3GjrnIBiTGtrq0ajiYuLKy8vX1hYYNQfGRnJzc1VKpVJSUlFRUWjo6NutxvHs+7ubp7nvV5vZWWlUqncs2fPuXPnfD4fbqitrY3dEP5V5Xn+3LlzmZmZNTU1mZmZFotFqrb0s8ViUalUg4OD6FCqSWdn54svvojlNDU1lZeXs03ES0aSw+F48cUXlUplamqqwWDAczg9Pb2zs5Pn+YWFherq6tLSUnyK2+1WqVRTU1NCmQqFoq6uTqPRaDSa+vp6n8/ndrujoqKwZW7dupWcnCxSZmlp6fTp00S1hdZjFNImBmPCCIUQ/StkZGRErVYvLS35LZSqZzAY0CgS4vP5GhsbNRqNQqEoLi52uVzSX3bkBVo5T/IO0QU8zwuvLru7u9n9lbZIlMkQIu2ySAFiHVpDPH188vQ5JZrFxGnCmMJ+hwTG4/HIZDJ8hSGC5uiLFy8mJyerVKqysjIUnxiOJuojHdu0OgaDQa1W79ix48qVK2yjSdXweDwnT55Uq9Varba5uRnbwel0FhYWKpXK5OTk9vZ26VhFn9vb25OTk+Pi4o4fPx54GF5z/McYjuOKi4vtdvv4+HhGRkZzczP6Si2B53mNRnPlypXZ2dmJiYl33nlnYmKC53mr1Ypu25FNm5qaSktLJyYmRkdH8/Ly0MRmNCSkoKCgtbUVfW5ra1MqlQqFwul0StWWxhi3252amnr58mVcTaqJw+GQy+X4ejAjI6O3t5fWWWJzPM/r9XphR/DgnpiYiI2NlcvlMpksLS1NOJHa29tFUQEZpKmpaXp6Gslpb2/neT47O7u+vn5paWl+fl6n0xUXFwvP6unpkclkeXl5Xq+XbT1GYQgxRiiE6F8hNTU1dXV1gRSKJHs8HrVanZKSkpSU1NTUhKeowWDIzs42m80Oh6Ourm5wcDCEGCP1Ds0F/H8PaXZ/pS0SZdKE0LosVIBYh6E8bXzyzDklbJE4TRhTmNY74rQ6evSoTqcbGhqSRhqiozmOq6iocDqd4+Pjhw8frq6uZjuaqI90bBPrcBxXXl4+NTXV399vtVr9Gk0ktrKyUqfT2e12i8Vy4MCBjo4OVF5UVKTX66empsbHxzMzM4kxBjXtdDrHxsZyc3Nramr4DUJAMcZut6PDnp6e7Oxs9NkhYXZ2ViaTSX/dRIZWq9V49JhMpoMHD7IbwjQ3N+fn56MpdOXKlczMzKmpqby8PPS8ZXx8XKPRSFvEnwsLC0WOIWqSk5PzySef4BNRd6SdpXXQ5/PJ5XJhR/DgrqurO3DgwMjIyLVr17RaLb4O4nk+JSXFZDIJZ4LX6x0eHsYVent7kXqjo6NZWVnR0dEKhYLjuGvXrgk1WVhYGBwczMjIuHTpEsN67MJgY4xICNGqGK/XGxcXZzQa/RZKJbe3t+v1epfLhX7C8BTVaDSic0OIMVLv0FwgksPur6hFmkyaEFqXhWKJdWgNMcZn4HOKJ00TxhSm9Y44rebn5xsbG1NTU2Uy2f79+4XX+0RHcxyHo92NGzdSUlKk2kofCYr0kY5tYh2O42ZnZ4XVAjeaz+dTKpXospvn+b6+vpycHOwRXI49Io0xuJtDQ0OomxsC/zFGLpfjw9HRUWw+IqWlpVlZWQ0NDe3t7devX8dCsLFmZ2c5jsOXLSqVCgn021Bvb29KSorL5UKHeLQ5nU61Wm0wGIaHh7OysqQtos9NTU1RUVG/+c1vsECaJq2trRUVFTzPd3Z2lpSUsO0jbc7pdIo6gkbM0tKSQqEwm82o/MMPP8QzsKen5/Dhw7xkJgixWq07duzAh263+5133pGGYcRnn3124MABYYnIeoxCPsgYIxJCsyrm448/lr48IxZK1UtNTcU/YX19faj7brdbJpP5fULFjjEM72CELsBy/PaX/UQeyWQIIXZZJJZWh6g8bXzywcwpnjRNaFPYr4loeL3eGzdu5OTkoPeUYXE0TR9R/UDqBGs0p9MZHR2NTxwbG8MeEZZjj9Ae+PPMH4p1iCzkxQKJiYmikjt37nz00UdffPGFxWJxOp0NDQ3PPvvsu+++K6zj9XqjoqJu3bolk/1/01FR/te2/fWvf62uru7v709ISEANzc7OPvXUUxzH7dy5s7u7W6/X37p1Kzc3l3j6wsJCT0/Pxx9/XFtbW1RUtG3bNoYmRUVFSM6nn35aUVHB6KxftYXMzs4uLS1961vfQodZWVkOhwN97ujoaGho8CthZWUFf1YoFBcvXuzs7ESHy8vLJpPpmWeeQYcpKSlOpxNXFlmPURgsUiF+/dvd3S1deyMtlEq+e/fuxMTE7t270WFqaqqwj9/4xjdC7gXH9I4QoQsQoY1nkUyaEHaXEYHUoSkvJNg5RZwmRBgmYk+rxx577NChQ2i93FtvvYUKV+lomj5LS0vB1uGCN9r/KOwQJLr/7e3tZTwrE52Ll06JgrBSqZQ+FWE0NDs7u3///g8//BBXRneXY2NjuOTkyZMcx+EXbqJLAJlMNjo6yvO8Tqerra1la8LzfEZGxsDAQFxcHL45DflZWW9vL77ikMvl4+Pj6HNPTw+6U+Z5nuM4lUqFLpeioqLQpdPAwAC+GkL1hQ9hLl++LLxTQevN8F18X18friy1Hq2Q2B1GOU0Izao8z6Pn+NPT0+xComQ07fEjhd7eXmxAjUZjMpmElYNdV8aTvMNwgdAUjP7yEqPRZBKFMLqMxdLq0Bqijc+g5hRCNE0YU5hmIuK0Er2GGRwcxM+FpI6mXeDPz89HRUUJHy4JL/yl+kh7F0idoIzGflZms9lQOe1Z2ca9jwn0nb/D4bBYLFlZWcRX8YjR0dGCgoLPP//c5XLZ7faqqiqdTsd/vVYEe6K6ujonJwfd67S1tbW0tDAa8vl8+fn5dXV1wpX+PM/X1NQ8++yzFovF5XJ1d3er1eodO3bgtb8091itVrlcjh+JEDXhv14ogpQPBOI7f9wRPBpqa2sPHz48MTFhNBpTU1PxQiA8wYaHh2NjY9Fnt9utVqvPnTvncrmMRqPwWbzP50tJSenr6xPqoNPpSktLHQ6HyWRKT0/v6uqiWY9mUlp3iOUMITSr8jzf2tqq1+tFYkWFDMl6vb6goMBms5nN5vT0dPzk02AwHDx4EL0Krq2tResGCwoKysrK8DtSPDZo5VLvMFwgNAWjv1Jj0mTShNC6LBRLrMNQnjY+2XNKNIt5yTRh/FawTSTEarVqNJrLly87nU63241eLhoMBpqjGT++Bw8erKqqmpqaQo4W/ihL9Zmfn5fJZFarFT+Lk9Yhzgu20URiq6qqjh49Kn3nX1xcrNfrbTabxWKhvfPfzDEmkCXFiKWlpebm5tTU1OjoaI1GU1ZWhhfjNjc3KxQKvHa5vr5eq9UqFIrCwkIU2G2URdJo4ApBxvV6vY2NjcnJyXK5/MCBA1evXp2YmFAoFOj3heGeurq6559/Hn0masLzvMlk4r5eFRoIoiaEa0PxSkTUXG1trUaj2bNnD17kI5IjHDroplupVKakpLS1teHyDz74QPS6hef56enp0tLSuLg4rVZ7/vx5LFBqPZpJad0hljOE0KzK83xaWhpapydEVMiQ7HK5jh8/rlKp9uzZI1wL5/P5Tp8+rVar5XI5evuNDIIqJyUlNTY24lXRtHKid2guEJqC0V+iMYkyaUJoXRaKpdWhKc8Yn4w5xf/3LOYl04Q2hf2aSMRnn32Wl5cXGxurUCgyMzOFC0Gljmb8+KJlZkqlMj09vaOjQ7R2WapPY2OjsHfSOsR54ddoQrG0tctTU1M6nQ6tXW5tbd1kMeYRnucDf7AWOSYnJzMyMu7du7fWinAcx92/f1+tVjudTmGaDQAAhIimybqawhuX27dvP//88//+97/XWpGwATkxCVy7di03NxcCDAAwgGkSCUwmU0pKylprEU4gxoiZm5tDyzHXWpE15ssvv3z99dcZFZaXl48dO7aZLriAwIFpEkbeeuut9957786dO3/605+amppwssHNAcQYMfhp8lorssZUVFQkJyczKjz66KPR0dFvvvnmw9IIWEfANAkjeXl5XV1dWq22rKysrq7utddeW2uNwkoI73DYfysTVgj83ZRfmUCAhGxJlFgXfXa5XFFRUcL1Zl6vt7S0VCTZaDQK/xkaMsKmGdTX18vl8sDXYoQdohGkhOCC69evZ2VlKRSKnJwcvO4x7K2sUghMfCAE1st9zOZJZL1hESZv93g8CoXiscceQ4e0NPUqlcrj8YS3aRqBpNOPKEHt4xAsEcoPv/6Bib/pCSXGyGSy1NTUQCr4rSkE/6IB642pqan8/Pz29vY11AGFvSeffHL1//QOjYgawefzZWdnx8fHZ2dnS/9Pvk6AiQ+Ewirvg/r7+8NyOu2WWbqi3EZPcy38SqFQlJSUuFyuN998E/2FvqKiAv+FmLhQnbEIXbpnAU/PWE4UXlJSgv+2wvN8Tk4OLS28jZJCXMrIyEhOTo5cLler1ei/b9JeBNiEKHk70R3SQprXpIoxbCtqmmg9aTZ7YjVp7vcQ3Moe0iJpDBcQ/ylC1JBn5odn90ua1p7mdKIcYXdEO1/4JSxzH56VbXr838ckShB+W1FR8cILL3zxxRfBxrabN2++8MIL7ExHHMfV1dU5nU6j0djf39/X19fV1cVxnMfjMZvNN27cGBkZsdvtTU1NuL7H4zGZTENDQyaTyel0pqWluVwus9k8PDxss9lwTaJYBjqdrqKiwm63Dw0N5ebmyuVyjuNaWloWFhbMZnN/f//g4OClS5cYwktKSnp7e1GFf/3rXyaTSa/X0yR4PB6r1WqxWLq7u1HuI6IXjEbjyZMnp6amLBaLVqutra2Vah5gE9u2bcPJ21f/MCoQxTCiponWS0hIEKlHrNbW1jYwMDAwMDA2NpaUlDQ6OsrWk+jWoIY0racej+fW1xiNxra2NlRO0xBlGenu7u7v7//mN78paoV2FhrtaCI4nc7GxkZUTnM6wz5zc3NFRUWtra3PPfccKmFP/GANJSTAuQ9sEvxGIXaqLo/HYzAYVCpVSUmJMM8Eg7GxsZKSEpVKZTAY8I0F8XKGmOHHRk9zjb4SZqMS7uh148YNtKMiLXEQ7YKXtmcBMWM5TfjCwkJsbCzK5tTV1XX06FGaBBsphbjf7HDj4+Po9buoF4E3wfhfMa0wkItQpBj7j8r4W5r1RG3Rqklzv0uV9OtW9pBmdFnoAo6S5Z6oITs/PKNfHCmtPU/Ppc/YBEG684XfIReWuQ/3MZue1T4rQ8zOzur1euFutQxkMplerxft40YcasRs2IxfK78/ZOiQlmSbcbp0zwJaxnKacCQEZSjKz8+/evUqY5uDAGed0WjMz89PSkpCp0tTUATVRBhjjFSxAGMMw3pCCcRqxNzvUiXZbsXQhrRIGs0FxCz3NA3Z+eGD7RfN6Yzc+NKdLwJnlXMfYsymx39uf79p7f/+97+fO3ducHCwpaUlkDunlpaW9vb2mpqalpaWxx9/PJBT1hzpngVoWgaV1L2kpKSzs7OsrGxkZARtXB+4BKIX9Hp9VVXVpUuX5HI5WpIkqrP6zPOh4VexyBHUigDaVhSBD+kQeirSMMD88IH3i+10qRzizhdcYPtZ/C/MfWC1+I1C7Fvm6upqpVLZ0NAg3eqKgcvlqq+vVyqVaGNUPshnZau8j6E9aWHnA8fgPQuk2b8Zwnme93q9KpXq4sWLRUVFqIQogWgKqRemp6eFF48mk4m4O1PgTYTrPoaoGNu2YXxWJsr9zgfvVvaQFqrBcAFHyXIv1dBvfnhavxijneh0ohwbfecLv8/KwjL34T5m07PaZ2VlZWW2r3c+CBabzVZWVoY/E4eaNBv26mMMUSwqJ+YDp+1ZQMtYThPO8/zx48djY2N/+9vfokPaNgcBzjqNRtPV1eV2u8fGxvR6Pd45Q5hOPPAmhMnb7Xa78GkP0bw8z4+PjxN/r4mKMXKtC5umWU/UOrEaMck/rWmaW9lDWqQGsac2epZ7oobs/PC0sxijnTYy2bnxRTtf+CUscx9izKYnPO9jVk+wa5eFJ4YQY2hJton5wGl7FtAyltOE8zzf29urVCrZOc8Dn3WDg4PZ2dlyuXzHjh0NDQ24d8J04kE1gZO3e71e0cU18axPPvlEukcyTTFGrnVh0zTriVqnrV2WJvmnNc3YioKBSA1iT230HTGIGvrND088izHaaSPTb2584c4XDweIMZue9ZLbH1hvvPHGGxaL5fe//z2twuLiYlpa2tmzZ0+cOPEwFQMAYAMBMQYgs7y8bDKZnnnmGUadP/7xj9/+9rcfmkoAAGw41ku+MkAKO7t+pFPrP/roo+wAw3EcBBgAANhAjFm/sLPrQ2p9AADWPxBjws/k5OTWrVtDOHFubu7ChQvo88zMjNlsrq+vx98uLi4eO3ZMKLm+vn5gYGCV2oraZXPq1KmYmJj3339/9Y2GgNQCNEJ2AQAA4QVizDoi2Oz6DzO1PrfW2fUjmlofAIAIATFmYwDZ9deDBQAACBb/Meb+/fs//OEPExMTd+/e/Ytf/OLBgwfoQcSvfvWrffv2xcfHv/LKK3Nzc6iy8KstW7a8/PLLMzMzP/7xjxMTExMSEr7//e/fv3+fLRa3Ozk5GR8fjw9v3rz53HPPbd26ddeuXd/73vf+9re/cRy3uLh44sSJrVu37t279+c///mDBw9owl9++eVf/vKXWNqhQ4fQAx+iBKTJhQsXEhMTd+7c+d5779GMc/PmzUOHDsXExCQmJr700kv//Oc/pXUCbGJubi45Odnj8TzyyCPSh1F79+796U9/6tdZDK1o5pW2K7Uex3EzMzPCasQ6HMc9ePDgzJkz27dv37Jly0svvTQzMxOCW3/3u99JO0WzAMMFb7/99vbt2+Pj41977bX//Oc/NA0DtCoAACHgP8Zsjuz6xNT6DAkbOrv+alLrE63HSbLr09y3cbPrAwAQEdh/0XyY2fUZ/1tefXZ9Ymp9moSNkl0/8NT6xHOJ+RECyRjGqMPIHi9tN4Ts+uwuh5xdHwCACOEn7/L09PTS0tK+ffvQYVpaGpq9SqUSPwDRarUonThCqVTi1K1arTY2NjYmJgYdJiUloQ0NaWJpxMfHFxcX5+TkHD58OCkpKTs7+zvf+c7du3ddLhde3buysoISzRKFx8TEFBYW9vb2/uhHP+rp6UH7I9EkoF4IH+lwHLdr1y6pYn/+859Pnz49Ojq6tLS0srKysrIiqhBUE+HCr1YMAnENrc7c3Nzs7GxmZmaAbRHdynHcli1bzpw5U11dXVlZmZ6evry8HEJn5XL57t27sYZ2uz0EDQEAWCX+c/uvE1afXV+UWp8LMvX9Bsquv4ap9bkNmF0fAIDI4SfGaDSa6Ojor776Cl20Wq1Wxr8CA4coVqVSLSws3Lt3D90hORwO0VlPP/30008/zXFcYWGhTqd79913FQoF3nvDr86FhYVVVVUffPBBfn4+amLnzp1ECURMJpOo5M6dO06n82c/+xk6FO45jwmqibBA08qveRGBeJxWZ9u2bSqV6ssvv3zyySdx5RDc+vrrr1+9evXkyZNjY2MJCQkhdJbjOK/X+49//APdyoyNje3Zs4emIQAAEcTv07SHmV2flv49XNn1Ran1aRI2Snb9oFLrM8wrbJdhPWHrtDrELPTBupWRNF5qt7Bk1wcAIEL4jzEPM7s+Lf17uLLri1Lr0yRslOz6QaXWZ5hX2C7DesLWaXWIWeiDdSsDqd3Ckl0fAIAIAXmX1y/s7PqQWh8AgPUPxJj1i9/s+pBaHwCAdQ7EGAAAACBSQL4yAAAAIFJAjAEAAAAiBcQYAAAAIFJAjAEAAAAiBcQYAAAAIFJAjAEAAAAiBcQYAAAAIFJAjAEAAAAiBcQYAAAAIFJAjAEAAAAiBcQYAAAAIFJAjAEAAAAiBcQYAAAAIFJAjAEAAAAiBcQYAAAAIFJAjAEAAAAiBcQYAAAAIFJAjAEAAAAiBcQYAAAAIFJAjAEAAAAiBcQYAAAAIFJAjAEAAAAixf8BqEYeQ3VEHM8AAAAASUVORK5CYII=)

Research’s Comment:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAAAjCAIAAADNIk3yAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAFPElEQVR4nO3aS0gbWxwG8NMxtT4mtrFJfUU0UiS4ciHFFltRXGgoIipGbBYWoQWhJQQEySKmltJFKYgG6UZQN7qS4MqdIEGK9TEEX6D4iBBTSaKVGMaQOncxMASTSe4FD6Xe77eaOZz5/I+CnzPxjiAIBAAAgALmTw8AAAC3FjoGAABoQccAAAAt6BgAAKAFHQMAALSgYwAAgBZ0DAAA0IKOAQAAWtAxAABACzoGAABoQccAAAAtKTpmf38/Ozt7bW2NEBIIBFQq1fz8PCHkx48fz58/VyqVRUVFbW1tW1tbcouxLi4u3r59q9FoiouLP3z48Pv378PDQ6VS+fXrV51Op1KpXr169evXr2tXxe7Jzs42Go2BQKCvr0+j0Tx8+PD169cXFxdy+dLlsWkqlUo8lhv48vKyp6dHqVSWlJQMDAyIOQnDjUbjp0+fpPCnT59OTEzIJYiTfP78WaPRFBQUjI2N/fufEwDA3yhFx+h0OqvVajabCSE2m81gMNTV1RFCXr582d3d7fF4XC5XTU1NRkaG3GKs9+/fe73e1dXVubm52dnZ0dFRQkgoFHK73YuLi0tLSx6Px2q1xo8RCoU4jnO5XBzHeb1evV7v9/vdbvf3798PDg6kSxLmJyE38ODgYDgcdrvdc3NzCwsL3759kwvv6OhwOp3iVcfHxxzHtbS0yCWIN7K9vb2+vj4+Pl5TU5N8PACAv56QSiQS0ev1drtdrVb7fD5BEILBoEKh4Hk+dlvCxVjRaJRl2b29PfF0dna2urr64OCAEHJ+fi4uulyusrKyaxeKe87OzqQ9DMOEw2HxdHFx8fHjx3L54uUsy8amPXjwIPnAarU6FAqJxxzHPXnyRC48HA7n5OR4PB5BEEZHR5ubm+USpBsJBoNy3yIAgFtGkbKE7t6963A4GhoahoeH8/LyCCEqlaq9vb26urq+vr6wsLCqqqq2tjbhYmzOyclJJBLR6XTiqV6vF3/nsiwrvcvSarXBYDB+BpZl79+/L+3JycnJzMwUTwsLC/1+f5J8OXIDn56e+v3+0tJScdvV1ZVCoZALz8zMNBgMTqfz3bt3MzMz3d3dcgnSjUhv6gAAbr3UHUMI8fl8DMP4fD5pZWpqamVlZX193ev1WiyWZ8+ejYyMJFykNvkNSDgwz/MMwywvL0vFwDDJ3ih2dHQ4HA6TybS0tDQzM0MI+a8JAAC3VsonnbOzs/z8/Onp6dzc3M3NzfgNHMdptdqUi3LvyhK+yIqVfI90Kvc66/z8nGGY2Ndx8V/i2sAsy66urqYcXjzmeT43N3doaKi1tVXaH58QfyMAALde6r+vrVbrixcvjEajxWLp7e0lhGxtbTU1Nc3PzwcCgaOjI4fDUVlZmXAxNictLa2zs9NsNh8dHW1sbNjt9q6urhssS7l8pVJZVVVlsVh+/vy5s7PT398v7k8ysMlk6u3t3djYOD4+/vLly8ePH5MMf+/evcbGRpvN1tnZKQ0Tn3CDdwoA8NdIXkHLy8ssy4qfafM8X1paOjk5GYlE7HZ7eXl5enr6o0ePTCaTz+dLuHgtLRQKvXnzRq1Wa7Vau90ejUZv8DkmYb64vru7W19fz7JsRUXF8PCwuD/JwDzPm81mrVablZVlMBjExxe5cEEQnE4ny7LSvyHIJeA5BgD+b+4IgvCnaw4AAG4nfBYNAAC0oGMAAIAWdAwAANCCjgEAAFrQMQAAQAs6BgAAaEHHAAAALegYAACgBR0DAAC0oGMAAIAWdAwAANCCjgEAAFrQMQAAQAs6BgAAaPkHq6oNOmjDiisAAAAASUVORK5CYII=)

Mirror: Click here to view the mirror

Coordinated Disclosure Timeline

Vulnerability Reported: 15 January, 2020 23:05 GMT
Vulnerability Verified: 16 January, 2020 07:44 GMT
Website Operator Notified: 16 January, 2020 07:44 GMT
a. Using the ISO 29147 guidelines
b. Using publicly available security contacts
c. Using Open Bug Bounty notification framework
d. Using security contacts provided by the researcher
Public Report Published
[without any technical details]: 16 January, 2020 07:44 GMT
Vulnerability Fixed: 17 February, 2020 16:28 GMT
Public Disclosure: A security researcher can delete the report before public disclosure, afterwards the report cannot be deleted or modified anymore. The researcher can also postpone public disclosure date as long as reasonably required to remediate the vulnerability. 14 February, 2020 23:05 GMT