arzm.ru Cross Site Scripting vulnerability

2020-01-2615:26:00

geeknik

www.openbugbounty.org

JSON

Open Bug Bounty ID: OBB-1075231

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:

&nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence;
&nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence.

Affected Website:	arzm.ru
Open Bug Bounty Program:	Create your bounty program now. It’s open and free.
Vulnerable Application:	Custom Code
Vulnerability Type:	XSS (Cross Site Scripting) / CWE-79
CVSSv3 Score:	6.1 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N]
Disclosure Standard:	Coordinated Disclosure based on ISO 29147 guidelines
Discovered and Reported by:	geeknik
Remediation Guide:	OWASP XSS Prevention Cheat Sheet
Export Vulnerability Data:	Bugzilla Vulnerability Data
JIRA Vulnerability Data [ Configuration ]
Mantis Vulnerability Data
Splunk Vulnerability Data
XML Vulnerability Data [ XSD ]

Vulnerable URL:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAAAjCAIAAADNIk3yAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAL8ElEQVR4nO2cb0hb1xvH72JwIdyxLNwGl4Y2dcPKKF0pxUnJC/uHIiIuE5GupC4MKVKkiIi4MELIttRKCkU68cVelL7ZGEWK7IWMICWIdC6GWxuCy5ykIWShyyS1dyV1mXcv7m9nd/eec7yNidH+ns8rz81zn/M9z3lOnntObvuKKIoMAAAAAFQAXbUFAAAAAC8tUGMAAACASgE1BgAAAKgUUGMAAACASgE1BgAAAKgUUGMAAACASrErasyhQ4cePHhAau5m9pBUYK/z119/Xbt27eeff662kL0KBLAqVL/GPHz4cHNz891338U2dzN7SCrwElBTU7O5uTk0NFRtIXsVCGBV2KLGPHr06LXXXsN+9OTJk6tXr5Ka2pmenu7o6CA1dzNI6u+//37x4sV9+/bt37//k08++fPPPyl3kYyfP3/+4YcfyqONgv/o0aM33njjReVR5g7YSUqeCPWaGh4eTqfTP/zwQ5mkbUG5UmhnUlHLV5DGAG5z6QFySt/H5PP5QCBAamrnJagxPT09m5ubPM/Pzs7eu3fP7/dT7sIaP3/+vLW1tVgsllHewYMHc7lcGR0CO4x6TdXU1CwuLr733nvVkrSb0fIVBAHceap8Vvbrr78mEomWlhZsczeDpP7xxx8zMzMTExP79+8/fPhwMBj89ttvSXeRjLPZ7NmzZ4PBoNxYr9c3NDTI/3hRXn311RLuAoD/c7a/9IB/Eakkk0mWZW/cuGG3281ms8vlyufzoijm83nk4datW/Lm9evXWZYdGxuzWCwmk6mnp+fZs2ck/5OTk93d3djmwsJCc3OzwWDgOK6rqyudTiM9gUCA47i6urqvvvpK/f+tSTbBYNButxuNxu7u7lwuNzQ0xHGc2Wx2u92CIGCHKXcrXZEbmEwmrHKs5erqqtFojEajoijmcjmTyTQ7O0syVsigz8jMzIxGA+RNe0AymUxbWxvLsna7PRgMKoYssbCw4HA4WJa1Wq2dnZ3xeBw7KcVicWRkxGKxGI3Grq6uXC5HEkyKlRxBEC5dusRxnM1m8/l8xWJRPiiTyXThwgUpMyUKhcLHH3/MsuyBAwe8Xi+yV0+xQra6I5GQdSTUeauYVrU2bBeKJUbqjiIYuwYpvauDKV0fHR1V+KGkMTaFSH7o+tX+KZMuD9fFixfPnTuHbvd4PD09PaQAbrmgSrAE5Gy9jxEEgef5+fn5hYWFTCYzMjLCMMzrr7++vLzMsmyhUHC5XPLmBx98IAjCwsJCJBKJRCLRaHRsbIzknHJQFo1GL126lM1mY7GYzWbr7+9HepaXl2Ox2K1btxwOB8MwhX8YHh4+f/480jw3N8fzfCaTaWxszOVyS0tL9+/fTyaTHo8HO0yFWzr0M71Dhw55PJ6BgQGGYbxeb1tb26lTp7b0qQW3233mzJnFxUX1Rz/++OOZM2fcbrf6I40B6e/vr62tXVlZCYVCt2/fxgpob293u92pVGpubs7hcBgMBgYXvbGxsVAoFAqFEomE1WqNx+PS7ftUaInVlStXMplMNBqdmZmZnp6emJiQOl1aWpIyM5VKyafV7/c/e/ZsaWlpZmYmHA5PTk5iRaqvYDvCWqoHIlmS8pauTd2FYolh54IuGLsGKb1jgykIQuQf6GtZgpRCJD8k/SRIOuXh+uKLL8Lh8NOnT6WPpqenOzs7SQ4pC6pkS+A/0EtQMplkGGZ9fV1qzs/P19fXo48UzxroqZlhmFQqJV2fmpo6ceKE9HcqlbLb7egWQRBYll1bW8M25aysrNTV1SHnWJtYLHbgwIFcLifZoAecubk5nU6Hnpvm5+fffvtt7DDlbukbDrlUkuXGxkZjY6PP5+M4LpvNanGrZR8jCEIgEDCbzd3d3YlEQrqYSCS6u7vNZnMgEECbEsWMbBmQYrFoMBhWV1el61NTU+p9zNraml6vLxQK9OiJomixWKStiYK0ClKsEMVikWVZJGx6erq5uVmRmXNzcygzRVHkOA7Fgef5pqYm7BQrrmA7Ig0QOxAFUt4qplWtjdTFlvlAF4xdg5Te1cEk+SGlMSmFSH4o+kn7GMqky+9qbm6+c+cOuqjIWDnYBbVNS0COprMyeRN971BqjMFgQNfj8bjFYpH+LhaLmUwGfTQ1NXX69GlSMxqNnj171mq1Skc68s0yVurJkyfv3r1L16xuYseypRO5VIplKBRiGGZ8fFyjWy01RmJtbc3pdOr1eqmp1+udTqf8sEj874xoCUgmk6mtrUXX4/E49qzs/Pnzx44dGxwcDAaD9+7dw8rO5/N6vV4699CIOlYIhbBEIqH+4pYPam1tjWEY7h/MZrPFYtlyikkdYS0pqPNWfjtWG6mLLfulCMauQY29y7/TsX5I9qQUIvnRGHDFWZn6ujpco6OjbrdbFMWbN2/KT+NJKBZUWSwBCX0Ft0gqampq3nzzTdSkv1HmdDp7e3snJycNBkM6nW5tbaV4/vLLL+vr699///1KyFaj8eW3bDar0+my2Wx5e//ll1+8Xm84HEYvsPn9/mAwePnyZb/f/9Zbb5W3OwVff/314uJiLBbLZDKDg4MnT54k/YODmpoa9UV0poT47bffmLLGqlAo6HS6SCSi1/8vvXU63cbGxvY9yyENhJ63WG3lFUahur3vJJ2dndKR5nfffYc9PZajXlDbtwT+hV6CStvHMLJ98d27d9E+XU6xWOQ4Dm2TFc3Hjx/LnxR4nqfsY9LpdGNjIzpnKMs+Zn19XafTyXfl6C6FVEEQdDqd/CSqoaFBFMV8Pl9XV/fNN9+YzeZ4PE43JslQ09fXx7Ls4OCg4lf0XC43MDDAsmxfX5/Cm8aASAcdyWRSuo49K1PA87zNZsPKtlgsPM+rb8EeMWFjhSCdlVEGxbKs4qROyz5G49ENZSDYvFXcrtZG6qJcZ2XyNaild8XZlNoPaXWQUojkh6Sf5P+FjgGOHDkSCoVMJhPyg4W0oLZjCcgpvcYIgqDX69G5JGpK+SS9UROLxY4dO+bz+ZAHdDAaDoePHDmCriuaoihaLJaJiYl8Pp9IJJxOJ6XGdHZ23rlzB/3yr73GIDFYt01NTb29vdlsNpFIOBwOdJdaamtrq8vlymQykuWnn34qiuLly5elTfrnn3/e0tJCN6bIUOByudAaVpNMJl0ul8Kb9oB0dXU5nc5kMhmLxY4ePaquMfF4vLW1dXZ2NpfLpVKp3t7e9vZ2rOxAINDU1LS0tJROp/v7+8PhMGVQpFghent7Ozo6UqlULBY7fvz4+Pg4fVB9fX3Nzc3SZmtsbMzv92upMdiOSJYk1Hm7vr6u1+uXl5elw0O1NlIXiiWGhSSYtAa19K6oMVg/pNWBTSGKH6x+kn/6pCvC5fV6jx492t7eTp8v+oIqzRKQU3qNEUXR5/MZjUb0YqXUlN5dxr6nKPc2NDTk8XiQK0VTFMVwOHzixAmDwVBXVzc4OEipMYqdmcavVLkZ1u3Kysrp06dZln3nnXfGx8eRE7XUx48fX7hwwWw2W63WkZGRjY2NSCTCsqz04FYoFOx2++3bt0nGpGhvkxJqTDabbW9vl148HR0dVdeYjY0Nn8/X0NBQW1trsVhcLlc2m8XKLhaLw8PDHMcZDAan00l59KPECkF6d5k0qEKhMDAwYLPZjEZjW1vb6uqqxhqj5VVaOti8HRkZQStFrY3ShWKJqaEIxq5BLb0r1gj2HWjS6sCmEMUPVj/JP33SFeHieZ6hvvYN7Axb1JgS0LggGxoa7t+/T2ruZvaQ1O2wvLyMXtYA9hblfVgpmeqmkCAIBoMB+w4qsJPs6G/+cn766SdKczezh6RuB57n6+vrq60C2MNUN4W+//57h8MB/9tY1alajQF2IZ999pnVau3o6FhdXfV4PF6vt9qKgD3GLkmhJ0+e3Lx5U/oX2UB1eTnfXARKo6WlZWJiwmazuVyuK1eufPTRR9VWBOwxdkkKoR9+qtI7IOcVUfWbOQAAAACUBdjHAAAAAJUCagwAAABQKaDGAAAAAJUCagwAAABQKaDGAAAAAJUCagwAAABQKaDGAAAAAJUCagwAAABQKaDGAAAAAJUCagwAAABQKf4GsO+yA8+CTP0AAAAASUVORK5CYII=)

Mirror: Click here to view the mirror

Coordinated Disclosure Timeline

Vulnerability Reported:	26 January, 2020 15:26 GMT
Vulnerability Verified:	27 January, 2020 08:02 GMT
Website Operator Notified:	27 January, 2020 08:02 GMT
a. Using the ISO 29147 guidelines
—	—
b. Using publicly available security contacts
c. Using Open Bug Bounty notification framework
d. Using security contacts provided by the researcher
Public Report Published
[without any technical details]:	27 January, 2020 08:02 GMT

JSON