Lucene search

K
openbugbountyRaviakp1004OBB:1117558
HistoryMar 13, 2020 - 1:59 p.m.

ca.webd.top Cross Site Scripting vulnerability

2020-03-1313:59:00
raviakp1004
www.openbugbounty.org
5

Open Bug Bounty ID: OBB-1117558

Security Researcher raviakp1004 Helped patch 589 vulnerabilities
Received 4 Coordinated Disclosure badges
Received 5 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affectingca.webd.top
website and its users.

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:

&nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence;
&nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence.

Affected Website: ca.webd.top
Open Bug Bounty Program: Create your bounty program now. It’s open and free.
Vulnerable Application: Custom Code
Vulnerability Type: XSS (Cross Site Scripting) / CWE-79
CVSSv3 Score: 6.1 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N]
Disclosure Standard: Coordinated Disclosure based on ISO 29147 guidelines
Discovered and Reported by: **raviakp1004 Helped patch 589 vulnerabilities
Received 4 Coordinated Disclosure badges
Received 5 recommendations **
Remediation Guide: OWASP XSS Prevention Cheat Sheet
Export Vulnerability Data: Bugzilla Vulnerability Data
JIRA Vulnerability Data [ Configuration ]
Mantis Vulnerability Data
Splunk Vulnerability Data
XML Vulnerability Data [ XSD ]

Vulnerable URL:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAAA3CAIAAABVZQ1/AAAACXBIWXMAAA7EAAAOxAGVKw4bAAASF0lEQVR4nO2dfUxTVxvAj1hqhQtIbSsCKsWFoTGuIYzhxhbmJ2GM1C9kjCkqUTSEEYJO2cY6xpAhOIeO8cdcmCGbMcYQZogzlS0NY34gVNaxWlGx1tIhYNGKtVTu+8d535v79n4UlSLI8/ur59zT5+sc7nPvub0PU0iSRAAAAADgAbyetwEAAADACwvkGAAAAMBTQI4BAAAAPAXkGAAAAMBTQI4BAAAAPAXkGAAAAMBTjN8cI5fLL1++zNWcPExax5lAKABgwjFOc8xff/01PDz8yiuvsDYnD5PWcSYQCgCYiLjJMTdv3vTz82M9NDAwsG/fPq7mM1JfX5+cnMzVHBt4fHcZFhgYyOwflYDwOz4SC0foxVMMHl3cqqZCcffu3c2bN0ul0pCQkI8++mhoaMjTqicKlCNca3J0OXTokFwu9/X1fe21186ePetpdcAE5envY6xWa0lJCVfzGRkPOeYZGZWATETHPQQVioyMDIfDodVqGxsbm5ubCwsLn7dpk5FDhw4dPHjwhx9+MBqNu3fvTk1N/eOPP563UcB4RPC8DWChu7vbYDDEx8ezNicPk9ZxJlQoHj582NraqtfrfX19EUIHDhxIS0sbxRvoCY1AIIiIiKB/8BylpaW1tbVvv/02Qmjt2rW9vb2lpaW//PKLR5UCE5ER3cd88803crl85syZH3zwwcDAAEJoYGAgLCzMZrNNmTLlxx9/pDcPHDjg5+e3f//+WbNmBQYGbtq06eHDh1jOxYsX33zzTT8/v5CQkLVr1/7zzz+s6urr61euXOnt7c1sPn78eO/evbNmzfL19V2/fn1fXx8lecmSJdOnT5dKpevXr799+zZd4OrVq/fv348/X758edq0adgLhND27dt37dqFEHr06NHWrVv9/PzmzZv32WefPX78GA/46quvmI7cvn171apVfn5+L7/88k8//cR0wSU+CKEHDx5s375dKpXOmTPn888/x/Lx5gZrrFwc7+7ufuedd/z8/ORyeUVFBetOCKsKHi/4g8YzX6yxYpWGHdy3b59UKp09e/aRI0d4JhGxrTSXUEyfPv3WrVs4wSCEOjs7g4ODWU1lVc2jnUs1K3gB+Pr6zp8//+uvv8bT4bLn5rJhxQwa08Jvv/121apV1Fc+/vjjTZs2sRpw48YNX1/ftrY2hFBfX19gYOBvv/0WEhJy6dIlhFBISMj58+fxyF9//ZXfF/oY1hnfsGHDl19+SQ1esmRJdXW12WyOi4ujOrds2XL48GG3ioBJiPscY7PZtFptc3PzhQsXzGbznj17EEIBAQF6vZ4gCLvdnp6eTm+uXr3aZrNduHChpaWlpaWltbW1rKwMi0pKSsrIyDAajU1NTXFxcSKRiFUjz0ZZWVmZWq1Wq9UGgyE4OLijowP3t7a2btu2zWKx6HS60NDQ7OxsusCkpCS1Wo0/nzp1anh4+PTp07ipVqsTExMRQkVFRYODg+3t7adPn9ZoNNXV1dj3lv9BdyQ7O9vf37+jo6OhoYE1x7jEByGUk5NjNptbW1tPnz5dX19fVVVFhZc1Vi6OZ2dnC4XCzs5OtVp99OhR1rjxqGD1gj9oiHu+WGPFJc1ms+n1ep1OV1NTg89KXJPIutKYoaC4cuVKfn5+eXk5l6lM1VzaeVSzgheAXq8/c+ZMTU0N/2CeoLlYqFQqNRrN/fv3Ka/XrFmDEJIykMvlBQUFubm5CKHCwsLExER8S8EkIyNj2bJlOPcwuXjx4rJlyzIyMnCTNYwpKSl1dXV4QHd3t1arjY+PF4lE1FUgQsjb23vevHkjiQMw6SB56erqQgjdu3cPN5ubm8PDw6lDBEHQR+Im/orRaMT9J0+ejI6OJkmyv79fIBDY7XamFqPRGBYWhj/bbDaCIPr7+1mbMpmstbWV3+bOzs6goCB6j9ls9vHxwapjYmLy8vLS0tKwqf7+/g6HgyRJiURis9nweK1WGxMTw+WI0+kUiUT0/hkzZrCGjoqP0+kkCOL69eu4WV9fHxsbyxMrF8exRurrlMZnVMEMGl0gz3wxY8UqjdJOTR+GdRJ5VprLGsCYTKbw8PBjx45xmcqqmlU7j2pWuBYA8y+CvjC4FpiLhbGxsSdOnKCkYadMDEiSdDgckZGRKpVKIpFYLBYua202W0lJiVgsTklJMRgMVL/BYEhJSRGLxSUlJdgwrhkfHBz09/fH/lZVVSUnJ9M9zc/Pl0gkEomEP2jApMV9juH6s+HJMSKRiOrv6OiQyWT4c2pqqkKhyMvLKy8v//3336kxTqfTbDbjzydPnly6dCl1iN60Wq0CgcDpdDLtbG1tXb58eXBwsEQiEYvFzJO+QqFobGy0WCyhoaFWq1Umkzmdzu+//37NmjUkSfb39yOEJP9DLBbLZDIuR8xms0u/2xxjNpuFQiF1yGAwUKdgrljRHXf5OqXxGVUwg+Yyp6zzxRorrilwEUhyTyLPSnNZEpjY2NjKykoeU5mqubTz5wYmXAuARw7XAmNaWFpampGRQZLk4cOHU1JSeMwgSRLfndPjwEV/f79SqRQIBFSPQCBQKpVWq5U+jOsvNDU1FWtZvnx5bW2tyWSiImC1Wk0m07lz5/iDBkxaxvSZ/88//3zp0iWdTmc2m/Py8l5//fVDhw4hhKZOnTp79mw8xu0vyqZOncqUrFQqMzMzq6urRSKRyWRKSEhwGZCYmKhWq69fv56UlBQQEKBQKDQaDbVRZrfbvby8WlpaBIL/BsTLy8vhcIye60/MGPyizG3QWOeLNVYjkUaHdRK5YIaiu7u7vb39zz//5DE1Pz9/VLSPCiNfYGvWrMHbeqdOnaK2sKRSqcuwO3fuIIQsFouXl5fFYuHXfu3atcLCQo1GU1RURHUWFRWVl5fv3LmzqKho/vz5uJPrLzQlJeXw4cPp6ekXLlw4efLk8PCw3W4fGhry9vYOCAgICAjo6enx8fF58sAAkwD+FPR09zGItjlTV1fHujmj1WpDQ0NdOp1Op0QioTZ8XJokScpkMq1W6/Ktnp4e+gWaVqtlXlI1NzfHxMQkJyc3NDSQJFlVVZWTkxMUFETdPxEEwbqFwnTEZaukrq5utPbK6Cpc4iASibq6unDzWfbKKBWsQWO9sqYGUPPFjBXXFLAKZJ1ErpXGXAO406WHaSqXL0ztT3ofw7UA7t275+XlRe25NTU10eWwLjBWCxctWqRWq2fMmEGJYt0rs1qtQUFBx44dE4vFHR0dXNZmZWURBJGXl9fb2+tyqLe3Nzc3lyCIrKws5hfpM26328Vi8cGDB/F9P0mSwcHB9Bud8vLyhIQELhuAyczT5xibzSYQCKgdXqqJT2rr1q0zmUw6nU6hUKhUKpIkOzo6EhISGhsbe3t7jUZjZmZmUlISJRnvAms0mkWLFlGdLk2SJEtKSmJiYtrb200mU3Z2tkajwf0ymayqqspqtRoMBqVSiY102VmWyWQymYza4Pb391coFNTRrKys2NhYfAVXVlZWVFTE5QhJkkqlkt5PxYSu0SU+mZmZycnJRqNRp9NFRUXhnQcuFUzH161bp1Qqu7q6dDrd4sWLqZOaQCDQ6/V48+eJVLAGjS6QZ76YseKaAtbTKOskcq00ZiiYoWY1lesMztT+pDmG5F4AMTExmZmZFovFYDDExcXR5bAuMFYLCwsLFy9eTP/rYGXnzp14M624uDg+Pp5rWHp6OnV1wkpXV1d6ejrp7i80LS3N39//+PHjuFlZWRkeHt7Y2NjT01NbWysWi5ubm/kNBiYnT59jSJJUqVQ+Pj41NTX0ZkVFBUEQpaWlMplsxowZGzduHBwcJEnS4XCoVKqIiAihUCiTydLT06kHlZSW/Pz8goICSr5LkyRJp9O5e/duiUQiEomUSiV1aabRaKKjo0UiUVBQUF5eHusleVpa2rp166hmdHQ0Xbjdbs/NzQ0NDfXx8UlMTLx+/TqWUFZW5uIISZImk2nlypUEQURERJSXl3OdT+nxsdls27Ztk0gkoaGhKpUKZwX8FWasmI5bLJakpCSCIMLCwkpLS6lZ2LNnz0hUsHrBDBpdIM98MWPFJY31NMo6iVwrjRkKkrEOWU3lOoMztT9FjsELwMfHJzw8nFoAJEl2dnYuXbqUIIiFCxdWVlbS5XAtMKZwrVaLEKL+rFhpaWkhCALfS9nt9rCwsKNHj/Lb7BaeGSdJsq6ujiAIavGQJFlZWRkWFiYUCqOiohobG59RO/Ci4ibHPAU8+y1uiYiIOHfuHFfzxYMrVvyO6/V66rn9C8/4XwMjyUlPhM1mE4lEzF/EAcBEZHy953/lyhWe5uSB33GtVhseHj5mxjxfJuEaOHPmTFxc3BgUHAOAMWCc1l2e6Fy+fHnHjh1cR4eGht57771///135AK/+OKLI0eO3Llz5/z58wUFBVlZWaNhJsAH881HDPWOpCcYGBjAv1r2nAoAGEvG133MC0NGRkZqairXUW9vb6FQmJ+fX1xcPEKB8fHxubm5O3funDt3bk5ODleJEWAUwc9FmHi0SLNMJktKStq4caPnVADAWDKFJMnRlXjz5s1FixaN7rXezZs3FQrF3bt3R1Hm6DIwMFBVVbV3716EUF9fn0wmGxwcnDZtGkLo7t27OTk5DQ0NIpEoPT29uLjY29u7ra0tMTGxu7v7eRsOAADgQWCvbHSgV/K32Ww+Pj44wSCEtmzZMjw83N7erlarNRoNHiYWi20223MzFwAAYEyAHONZHj16dOrUqaqqqpCQkAULFpSXlx8/fvx5GwUAADBGuM8xzIrxuCZ5RUWFXC4PDAx8//333dZCZ5WD+7kqzLutn0/BVSGftbo7T4197JGvr++GDRv6+vp27dollUpnzpy5efPmBw8e8ChiVvKnsNvtw8PDQqEQN0Ui0eDgINOFkRRgBwAAmHC4zzGsFeNtNlt7ezuuhW40GgsKCp5ODuKuCc9VP5/5Ox/EXSGfWd2dpwC+VqttamrSarVmszkyMrK3t7e9vf3cuXNdXV2Ug6yKmJX8KQICAqKiogoKCoaGhu7fv69SqaKjo5nB4S/ADgAAMFHhf32GtQqWSy30pqYmellvrle7WatpuUDVhOepn8+s3cRVvp5ZO52/qBdVg7apqcnLy4t6pbm5ufmll16ihrHWyad77RKBjo4OhUIhFApx0cAzZ84wx3AVYAcAAJjQuLmP6enpcTgccrkcNyMjI/F5liAI6hecoaGhuHT5U8hBCLW1ta1YsSIkJEQqlcbExNjtdjweITRnzhxqPCUqhAFCSCQS0QcbjUb8mSAI+rtsPGYQBBEQEEB55O/vP336dNwMDg7u7e3Fn7kU8bBgwYK2traenp7i4uLo6OgVK1Ywx/j6+u7du7ezs9PhcCxcuNCtTAAAgAnB83/mr1Qq33rrLY1Go9VqGxoa3I5n3Ssb//j4+Bw8eLCwsJBrwLVr13CJRnoBdgAAgAmNm3cwZTKZUCi8ceMGvvbX6/VhYWFPoYZLzp07d8xm86effoqHUbcLMpkMIXTr1i1802AwGChRzDfjnE6n3W6nD547d66H3BmhIiY1NTUSieTdd99lPbpjx47a2tpt27YZDIaZM2c+kUkAAADjFjf3MVOnTk1NTc3Nzb1169bff/+tUqnS0tJGIvfR/4MQYpUjlUrFYvF33303MDBw9epVlUpF6U1ISMjLy7t9+zYeT0lm3StDCNEHJyUlja47dFgVSSQSu91+9epVhJCXl5fT6aR/5fHjx6WlpXQvnE4n9e+qEEI2m02n01VUVECCAQDghcLtExtmxXj+WujUEw461dXVrJXnSY6a8CRH/XxWuCrks/76gKcAPo9H9Er1TEUYqpK/3W4XiUT0R/dHjx6Nioqim3HixInFixe7iz0AAMDEZvRryYw9nqhe84yKPvzwQ51Od/bsWdajjx49ioyM/OSTT7Zu3TraNgIAAIwjoCamRygvL+eqqIgQmjZtWm1t7RtvvDGWJgEAAIw9z/93ZS8k3t7er776Ks8ASDAAAEwGIMcAAAAAnuJFeB4DAAAAjE/gPgYAAADwFJBjAAAAAE8BOQYAAADwFJBjAAAAAE8BOQYAAADwFJBjAAAAAE8BOQYAAADwFJBjAAAAAE8BOQYAAADwFJBjAAAAAE8BOQYAAADwFJBjAAAAAE8BOQYAAADwFJBjAAAAAE8BOQYAAADwFP8BqM0q3JBf9N8AAAAASUVORK5CYII=)

HTTP POST data:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAAA3CAIAAABVZQ1/AAAACXBIWXMAAA7EAAAOxAGVKw4bAAASF0lEQVR4nO2dfUxTVxvAj1hqhQtIbSsCKsWFoTGuIYzhxhbmJ2GM1C9kjCkqUTSEEYJO2cY6xpAhOIeO8cdcmCGbMcYQZogzlS0NY34gVNaxWlGx1tIhYNGKtVTu+8d535v79n4UlSLI8/ur59zT5+sc7nPvub0PU0iSRAAAAADgAbyetwEAAADACwvkGAAAAMBTQI4BAAAAPAXkGAAAAMBTQI4BAAAAPAXkGAAAAMBTjN8cI5fLL1++zNWcPExax5lAKABgwjFOc8xff/01PDz8yiuvsDYnD5PWcSYQCgCYiLjJMTdv3vTz82M9NDAwsG/fPq7mM1JfX5+cnMzVHBt4fHcZFhgYyOwflYDwOz4SC0foxVMMHl3cqqZCcffu3c2bN0ul0pCQkI8++mhoaMjTqicKlCNca3J0OXTokFwu9/X1fe21186ePetpdcAE5envY6xWa0lJCVfzGRkPOeYZGZWATETHPQQVioyMDIfDodVqGxsbm5ubCwsLn7dpk5FDhw4dPHjwhx9+MBqNu3fvTk1N/eOPP563UcB4RPC8DWChu7vbYDDEx8ezNicPk9ZxJlQoHj582NraqtfrfX19EUIHDhxIS0sbxRvoCY1AIIiIiKB/8BylpaW1tbVvv/02Qmjt2rW9vb2lpaW//PKLR5UCE5ER3cd88803crl85syZH3zwwcDAAEJoYGAgLCzMZrNNmTLlxx9/pDcPHDjg5+e3f//+WbNmBQYGbtq06eHDh1jOxYsX33zzTT8/v5CQkLVr1/7zzz+s6urr61euXOnt7c1sPn78eO/evbNmzfL19V2/fn1fXx8lecmSJdOnT5dKpevXr799+zZd4OrVq/fv348/X758edq0adgLhND27dt37dqFEHr06NHWrVv9/PzmzZv32WefPX78GA/46quvmI7cvn171apVfn5+L7/88k8//cR0wSU+CKEHDx5s375dKpXOmTPn888/x/Lx5gZrrFwc7+7ufuedd/z8/ORyeUVFBetOCKsKHi/4g8YzX6yxYpWGHdy3b59UKp09e/aRI0d4JhGxrTSXUEyfPv3WrVs4wSCEOjs7g4ODWU1lVc2jnUs1K3gB+Pr6zp8//+uvv8bT4bLn5rJhxQwa08Jvv/121apV1Fc+/vjjTZs2sRpw48YNX1/ftrY2hFBfX19gYOBvv/0WEhJy6dIlhFBISMj58+fxyF9//ZXfF/oY1hnfsGHDl19+SQ1esmRJdXW12WyOi4ujOrds2XL48GG3ioBJiPscY7PZtFptc3PzhQsXzGbznj17EEIBAQF6vZ4gCLvdnp6eTm+uXr3aZrNduHChpaWlpaWltbW1rKwMi0pKSsrIyDAajU1NTXFxcSKRiFUjz0ZZWVmZWq1Wq9UGgyE4OLijowP3t7a2btu2zWKx6HS60NDQ7OxsusCkpCS1Wo0/nzp1anh4+PTp07ipVqsTExMRQkVFRYODg+3t7adPn9ZoNNXV1dj3lv9BdyQ7O9vf37+jo6OhoYE1x7jEByGUk5NjNptbW1tPnz5dX19fVVVFhZc1Vi6OZ2dnC4XCzs5OtVp99OhR1rjxqGD1gj9oiHu+WGPFJc1ms+n1ep1OV1NTg89KXJPIutKYoaC4cuVKfn5+eXk5l6lM1VzaeVSzgheAXq8/c+ZMTU0N/2CeoLlYqFQqNRrN/fv3Ka/XrFmDEJIykMvlBQUFubm5CKHCwsLExER8S8EkIyNj2bJlOPcwuXjx4rJlyzIyMnCTNYwpKSl1dXV4QHd3t1arjY+PF4lE1FUgQsjb23vevHkjiQMw6SB56erqQgjdu3cPN5ubm8PDw6lDBEHQR+Im/orRaMT9J0+ejI6OJkmyv79fIBDY7XamFqPRGBYWhj/bbDaCIPr7+1mbMpmstbWV3+bOzs6goCB6j9ls9vHxwapjYmLy8vLS0tKwqf7+/g6HgyRJiURis9nweK1WGxMTw+WI0+kUiUT0/hkzZrCGjoqP0+kkCOL69eu4WV9fHxsbyxMrF8exRurrlMZnVMEMGl0gz3wxY8UqjdJOTR+GdRJ5VprLGsCYTKbw8PBjx45xmcqqmlU7j2pWuBYA8y+CvjC4FpiLhbGxsSdOnKCkYadMDEiSdDgckZGRKpVKIpFYLBYua202W0lJiVgsTklJMRgMVL/BYEhJSRGLxSUlJdgwrhkfHBz09/fH/lZVVSUnJ9M9zc/Pl0gkEomEP2jApMV9juH6s+HJMSKRiOrv6OiQyWT4c2pqqkKhyMvLKy8v//3336kxTqfTbDbjzydPnly6dCl1iN60Wq0CgcDpdDLtbG1tXb58eXBwsEQiEYvFzJO+QqFobGy0WCyhoaFWq1Umkzmdzu+//37NmjUkSfb39yOEJP9DLBbLZDIuR8xms0u/2xxjNpuFQiF1yGAwUKdgrljRHXf5OqXxGVUwg+Yyp6zzxRorrilwEUhyTyLPSnNZEpjY2NjKykoeU5mqubTz5wYmXAuARw7XAmNaWFpampGRQZLk4cOHU1JSeMwgSRLfndPjwEV/f79SqRQIBFSPQCBQKpVWq5U+jOsvNDU1FWtZvnx5bW2tyWSiImC1Wk0m07lz5/iDBkxaxvSZ/88//3zp0iWdTmc2m/Py8l5//fVDhw4hhKZOnTp79mw8xu0vyqZOncqUrFQqMzMzq6urRSKRyWRKSEhwGZCYmKhWq69fv56UlBQQEKBQKDQaDbVRZrfbvby8WlpaBIL/BsTLy8vhcIye60/MGPyizG3QWOeLNVYjkUaHdRK5YIaiu7u7vb39zz//5DE1Pz9/VLSPCiNfYGvWrMHbeqdOnaK2sKRSqcuwO3fuIIQsFouXl5fFYuHXfu3atcLCQo1GU1RURHUWFRWVl5fv3LmzqKho/vz5uJPrLzQlJeXw4cPp6ekXLlw4efLk8PCw3W4fGhry9vYOCAgICAjo6enx8fF58sAAkwD+FPR09zGItjlTV1fHujmj1WpDQ0NdOp1Op0QioTZ8XJokScpkMq1W6/Ktnp4e+gWaVqtlXlI1NzfHxMQkJyc3NDSQJFlVVZWTkxMUFETdPxEEwbqFwnTEZaukrq5utPbK6Cpc4iASibq6unDzWfbKKBWsQWO9sqYGUPPFjBXXFLAKZJ1ErpXGXAO406WHaSqXL0ztT3ofw7UA7t275+XlRe25NTU10eWwLjBWCxctWqRWq2fMmEGJYt0rs1qtQUFBx44dE4vFHR0dXNZmZWURBJGXl9fb2+tyqLe3Nzc3lyCIrKws5hfpM26328Vi8cGDB/F9P0mSwcHB9Bud8vLyhIQELhuAyczT5xibzSYQCKgdXqqJT2rr1q0zmUw6nU6hUKhUKpIkOzo6EhISGhsbe3t7jUZjZmZmUlISJRnvAms0mkWLFlGdLk2SJEtKSmJiYtrb200mU3Z2tkajwf0ymayqqspqtRoMBqVSiY102VmWyWQymYza4Pb391coFNTRrKys2NhYfAVXVlZWVFTE5QhJkkqlkt5PxYSu0SU+mZmZycnJRqNRp9NFRUXhnQcuFUzH161bp1Qqu7q6dDrd4sWLqZOaQCDQ6/V48+eJVLAGjS6QZ76YseKaAtbTKOskcq00ZiiYoWY1lesMztT+pDmG5F4AMTExmZmZFovFYDDExcXR5bAuMFYLCwsLFy9eTP/rYGXnzp14M624uDg+Pp5rWHp6OnV1wkpXV1d6ejrp7i80LS3N39//+PHjuFlZWRkeHt7Y2NjT01NbWysWi5ubm/kNBiYnT59jSJJUqVQ+Pj41NTX0ZkVFBUEQpaWlMplsxowZGzduHBwcJEnS4XCoVKqIiAihUCiTydLT06kHlZSW/Pz8goICSr5LkyRJp9O5e/duiUQiEomUSiV1aabRaKKjo0UiUVBQUF5eHusleVpa2rp166hmdHQ0Xbjdbs/NzQ0NDfXx8UlMTLx+/TqWUFZW5uIISZImk2nlypUEQURERJSXl3OdT+nxsdls27Ztk0gkoaGhKpUKZwX8FWasmI5bLJakpCSCIMLCwkpLS6lZ2LNnz0hUsHrBDBpdIM98MWPFJY31NMo6iVwrjRkKkrEOWU3lOoMztT9FjsELwMfHJzw8nFoAJEl2dnYuXbqUIIiFCxdWVlbS5XAtMKZwrVaLEKL+rFhpaWkhCALfS9nt9rCwsKNHj/Lb7BaeGSdJsq6ujiAIavGQJFlZWRkWFiYUCqOiohobG59RO/Ci4ibHPAU8+y1uiYiIOHfuHFfzxYMrVvyO6/V66rn9C8/4XwMjyUlPhM1mE4lEzF/EAcBEZHy953/lyhWe5uSB33GtVhseHj5mxjxfJuEaOHPmTFxc3BgUHAOAMWCc1l2e6Fy+fHnHjh1cR4eGht57771///135AK/+OKLI0eO3Llz5/z58wUFBVlZWaNhJsAH881HDPWOpCcYGBjAv1r2nAoAGEvG133MC0NGRkZqairXUW9vb6FQmJ+fX1xcPEKB8fHxubm5O3funDt3bk5ODleJEWAUwc9FmHi0SLNMJktKStq4caPnVADAWDKFJMnRlXjz5s1FixaN7rXezZs3FQrF3bt3R1Hm6DIwMFBVVbV3716EUF9fn0wmGxwcnDZtGkLo7t27OTk5DQ0NIpEoPT29uLjY29u7ra0tMTGxu7v7eRsOAADgQWCvbHSgV/K32Ww+Pj44wSCEtmzZMjw83N7erlarNRoNHiYWi20223MzFwAAYEyAHONZHj16dOrUqaqqqpCQkAULFpSXlx8/fvx5GwUAADBGuM8xzIrxuCZ5RUWFXC4PDAx8//333dZCZ5WD+7kqzLutn0/BVSGftbo7T4197JGvr++GDRv6+vp27dollUpnzpy5efPmBw8e8ChiVvKnsNvtw8PDQqEQN0Ui0eDgINOFkRRgBwAAmHC4zzGsFeNtNlt7ezuuhW40GgsKCp5ODuKuCc9VP5/5Ox/EXSGfWd2dpwC+VqttamrSarVmszkyMrK3t7e9vf3cuXNdXV2Ug6yKmJX8KQICAqKiogoKCoaGhu7fv69SqaKjo5nB4S/ADgAAMFHhf32GtQqWSy30pqYmellvrle7WatpuUDVhOepn8+s3cRVvp5ZO52/qBdVg7apqcnLy4t6pbm5ufmll16ihrHWyad77RKBjo4OhUIhFApx0cAzZ84wx3AVYAcAAJjQuLmP6enpcTgccrkcNyMjI/F5liAI6hecoaGhuHT5U8hBCLW1ta1YsSIkJEQqlcbExNjtdjweITRnzhxqPCUqhAFCSCQS0QcbjUb8mSAI+rtsPGYQBBEQEEB55O/vP336dNwMDg7u7e3Fn7kU8bBgwYK2traenp7i4uLo6OgVK1Ywx/j6+u7du7ezs9PhcCxcuNCtTAAAgAnB83/mr1Qq33rrLY1Go9VqGxoa3I5n3Ssb//j4+Bw8eLCwsJBrwLVr13CJRnoBdgAAgAmNm3cwZTKZUCi8ceMGvvbX6/VhYWFPoYZLzp07d8xm86effoqHUbcLMpkMIXTr1i1802AwGChRzDfjnE6n3W6nD547d66H3BmhIiY1NTUSieTdd99lPbpjx47a2tpt27YZDIaZM2c+kUkAAADjFjf3MVOnTk1NTc3Nzb1169bff/+tUqnS0tJGIvfR/4MQYpUjlUrFYvF33303MDBw9epVlUpF6U1ISMjLy7t9+zYeT0lm3StDCNEHJyUlja47dFgVSSQSu91+9epVhJCXl5fT6aR/5fHjx6WlpXQvnE4n9e+qEEI2m02n01VUVECCAQDghcLtExtmxXj+WujUEw461dXVrJXnSY6a8CRH/XxWuCrks/76gKcAPo9H9Er1TEUYqpK/3W4XiUT0R/dHjx6Nioqim3HixInFixe7iz0AAMDEZvRryYw9nqhe84yKPvzwQ51Od/bsWdajjx49ioyM/OSTT7Zu3TraNgIAAIwjoCamRygvL+eqqIgQmjZtWm1t7RtvvDGWJgEAAIw9z/93ZS8k3t7er776Ks8ASDAAAEwGIMcAAAAAnuJFeB4DAAAAjE/gPgYAAADwFJBjAAAAAE8BOQYAAADwFJBjAAAAAE8BOQYAAADwFJBjAAAAAE8BOQYAAADwFJBjAAAAAE8BOQYAAADwFJBjAAAAAE8BOQYAAADwFJBjAAAAAE8BOQYAAADwFJBjAAAAAE8BOQYAAADwFP8BqM0q3JBf9N8AAAAASUVORK5CYII=)

Research’s Comment:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAABLCAIAAAAphcDFAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAXd0lEQVR4nO2df0wT5x/Hz8qgYIuCbeVH/QrOoWOMMSQEF+aI2Q/WNaTizzE2XUZwMcgImUTRMaabMsVlc4y5xS3OLJsxyogxhCydM4wQxxi7If5C4wBrQUS0iqxUaL9/PNmTW++55+5KD9B9Xn+1T597Pj+e5+7pPde+nykej4cBAAAAAAVQTbQDAAAAwAMLzDEAAACAUsAcAwAAACgFzDEAAACAUsAcAwAAACgFzDEAAACAUsAcAwAAACgFzDEAAACAUkyKOcbhcOzcuRO97urq0mq1fmzc7w1KtNLV1RUWFoZfT+Ewe/bszZs337t3b3w85Hrid7h9x7U4DjkXYmKtjyeK9qxvEMcD8F9mUswxt27d2rFjx0R7oSwajcbpdDqdzqGhobq6upMnT27btm2infIDxL6bM2dOf3//hPgDTCz/hXMZkMWkmGP+IwQFBQUFBQUHBz/++OOVlZVHjhyZaI8UJCgoaKJdAABg4hGfY0ZHRzdv3jxr1qxp06atWLHixo0bDMPcvXt33bp1er1+9uzZ77333ujoKPPPGsXu3btnzZoVFha2Zs2av//+m2GYzz777IUXXsANbtmyZc2aNfitw+GIiYkZHBycMmXKN998gwo/+eST2NjYmTNnvvrqqw6HAxUODw+/8cYbWq12zpw57777LjLK5bffflu0aFFwcLBer1+xYsXVq1fxRx9++KGXV8QoVq1a9cEHH+CjFi1ahFwSNS0XtVrtdDql1yeGhhK+Z8+e2NjYsLCwV155Befq6tWrL7zwglarnT9//nfffcdvUKizhGz99ttvTz/9tFarjY6OXrZs2blz5xiBvmM4q1UUD32Ojj6cMPweRw3u3LlTr9dHRkZ+9dVXDGkMLF26dPfu3aiRP//8MygoCPu8bt26jRs3CmWDOEiIRumx05NG71mh5PDD9FpRFFp26+npeemll7RabWxs7J49e3AdYrD08UAcbLKuJHwoUUhvBFAU8Tlm165dVqvVarV2dHRERUWdPXuWYZjCwkK73d7a2lpfX3/s2LHq6mpUeXBwsLm5uaWlpaWlpbW1ddeuXQzDWCyWhoaGO3fuoDrHjh3Lzs7G7U+fPv38+fNoKSk3Nxc1wrJsU1NTc3Oz3W7ftGkTqrlt27ahoaG2trb6+vqGhoZ9+/Z5udra2pqfn9/b29ve3m40GgsKCrBXLf+AvSJGsXLlytraWvRpT08Py7IWi0WKaVk4HI7y8nKTyST9EEpobW1tKFfd3d2lpaWovKCgIDQ09OzZs3V1dcQ5hhHoLCFbZrN57dq13d3djY2N6enparWaIfUd0QrRQ5+jow8nfCCxxwcHB8+fP9/e3n7gwIH09HSGNAbMZrPVakX1jx8/7na76+vr0Vur1Yp6jZgNoUHCNyoaOyVp9J4VSo7QCStKQUFBYGDgpUuXrFbrwYMHcTkxWMp4EBpssq4kcvFLI8BY8YhhMBhaW1u5JSMjIxqN5vLly+jtsWPH0tLSPB5PZ2cnwzDd3d2ovKamJiUlBb1OS0s7cuQIqoOGILdBVIhfMwxz+/Zt9LapqWnu3LnotU6nGxwcRK9Zlk1NTaW4fenSpYiICIpXxCiGhoZCQ0NR5erq6qysLImmuSHgkhkzZnCD0v1DYGBgTk4ObpB/LB2v0HCuGhsbUa5GRkbUajU3ZOwJ1z2hzuLbGhgYCAgI8Oo1ivO4UMjDsUTnkTCciKGh8oGBAVyTOAbsdntISAhqMzU1tbi4OCcnBx0eGhrqcrmEskEcJHyjorFTApfSs/zkEMP06jjucOXmR61W4wO55oTOCKHxIP0cpNTnQ4lCeiOAogTQZyCHwzEwMJCYmMgt7Ovrc7lcsbGx6O2CBQtQdzIMo1arZ8+ejcu7u7vRa4vFcvz48WXLlh0/ftxkMtEX6zUaDb7/jYqKGhgYYBjm5s2b/f39MTExqNztdgcEeDv/xx9/lJSUnD171uVyud1ut9tN8YoYRXBwsMlkqq2t3bBhQ01Nzdq1ayWaFiUkJIRlWYZhrFbrpk2b9u/fHxwcLP1wodC4uTIajShXfX19DMNwQya2KdRZfFthYWHLly9PS0tbsmRJVFRUSkrKM888I9FzoodjiY6RMJyEQtNoNNwVIeIYiIyMjIuLa2pqio+Pt9vtZWVlcXFxo6OjVqv12Weffeihh4jZoAwSL6NSYhcKXErP8pPT09MjdMLS6evrc7vd3APRCx/OCOnnIKU+wzB6vR63ef36dR+MAuOMpGvl1KlTx2gmOzsbrRIcP34cXbjl4nQ6VSpVS0sLHs0qlfdCn8ViycvL27dvn1qtttlsmZmZPhhauXJlVVVVbm5uc3NzTU2NRNPom+/o6CjO1eDgYEhICK6gUqmio6MZhlmzZk1lZeX+/fs3bNgg3Su/hDYWW99///3vv//e3t5ut9uLi4ufeuqpTz/9VFGLFMY+nOiYTCar1Xr58mWz2Tx9+vSkpKSGhga8UMaQslFaWio6SIj4vWeVTg4j7YxQCPRFDbifEL3TMRgMLMtySyTe4dbW1nJvThMSEqxW64wZM/AiAMZrrUzo5lej0Xit2nHp6+sLCAjAb1mWRQcKeSUUhdPpDA8P//jjj7Ozs3FrdNMIg8HQ2NiI31ZXV2dmZhKDOnTokNFoxIstomtllNCIufJaUamtrRVdK8NpEbLFhWVZo9FIcZ67Via6ICM3OgR9OBFD47sqNAaamppSU1OzsrLq6uo8Hk91dXVhYWFERITdbvfwwNkgDhJ65xJjpwQupWf5ySGGefv2bZVKxV2RE1or6+zsRG+5a2VCZ4SUtTLRc5B+JeFCiUJ6I4CiiM8xO3bsSE1NbWtrs9lsBQUFDQ0NHo8nLy8vKyuru7u7vb09OTl57969nn86dfny5Tabrb29PSkpqby8HLdTVlaWmJhoNpv5JgYHBwMCAjo6OjzUK8ubb76ZlpaGvjzu2rVr27ZtXu0YDIbq6upbt251dHRYLBbuHEP0ihiFx+PJyckJDQ09fPgwblnUtMfjqaqqiouLa2ho6O/vP3LkSHh4OJ5y+CdefHz8vn37uJ86/83IyIiU0IRyZbFYuCELzTHEtPBtnT17NjMz88SJE/39/d3d3Xl5ebgfuX3HbVz6HONDdB7qcBIKjXj5ExoDBoPBYDCg7wE2my00NDQpKQl9JJQN4iAR/QLBj50euGjPEpNDDDM1NTUvL6+3t7ejoyM9PZ3Y1PLlyy0WS2dnZ3t7e2JioujJKDQeZJ2D9CuJF0JRUBohPlkEFEJ8jhkZGSkpKdHpdGq12mKx9Pf3ezyewcHB/Px8nU5nNBrLy8vRBRGdGxUVFQaDYcaMGa+99trQ0BBuB93kHjhwgGilvLw8JCTkwIEDlBPM6XQWFRUZjcaQkBCTyYS//mAaGhpSUlLUanVERERxcTH3UrVr1y6+V8QoPB5PbW2tRqPhOi9qGvHRRx/FxMQEBgYmJCTU1NRwo/C60Hz77bcxMTEul8vzz8ngBZ6BREMj5spmsz3//PMajSYuLq6yspI4xwh1Ft+Wy+UqLy+Pi4sLDAw0GAy5ubm9vb38vuPHK3GOkRudhzqchHqceLkXGgM5OTnLly/H1VJSUkpLS9FroWwQB4noHMOPnR64aM8Sk0MM89KlS0uWLNFoNPHx8Xv37iU21dvbazabNRpNTExMRUWFlJNRaDwQB5sPVxIvhKIQakTuT2yAMTLF4/H4a9mtq6srISEB/27Si7t37+p0OrvdPtnUL/6b0Dtr8gPDiYJCyblw4cLixYuvXbsm90C5g80vg/N+H+EPDOP3P/8ff/wxPT0drgiAX4DhREGh5LAsO3fuXP+2CTzwyP4Nrm84HI6qqqrVq1ePjzngwQaGEwX/Jmf79u1RUVFZWVmXL18uLS0tKyvzS7PAf4dxuo/BS6LjYw54sIHhRMG/ycnIyKiurjYajbm5uYWFhUTZHgCgIfrEBgmpesbrWdn98kQuMzOzoqKCW1JfXx8VFSVUf2KzR3kIj9/ijh4HKL9WF60vpVxRxpKo8UyyXLi+TaqECzkw4c4AUhC/jxlnse77RRY+OzsbK5shamtrkbjZJEQoq9zy8ezo+6WXiYwlUZNZ+l6KbxPecRPuACCXyajtf1/IwmdlZbW0tHB/Y0MUZ5w8CGV1orJ9X/QywGfCO27CHQBkITLHcMW6jx49ygio7jMkrW+iqrmoSD5XrJuooO5VE0mgT5s2bdWqVTdu3Ni4caNer585c+brr79+9+5dVJOiHy7XPcysWbPS0tLwrcyvv/7qdDozMjKkSKZTxNul68PL2shAaGtIXO6lyi6qn0+0TtwZgaLbT0ys3A0auIh2n9yNKvh9xJevF3KYb4sufS9lJEuJUUjGn77DgsQtNrw6jn6GEr2VFazQxgf8rgcmLSJzDFese+nSpUKq+4yA1jdf1VyWSD5RQZ0L8qexsZFlWbvdvmDBgv7+/ra2tlOnTnV2dmJFdIp++Fjc4y6X1dbWms1m6cJuQuLt0vXh5W5kQMdLlV1UP59onbgzgpCfQowlLtHuk7tRBb+P+PL1Qg7zbdGl76WMZCkxEsMR3WFB+hYbXETPUKHLgsRg5Q4eYDIi+sRGSKedq7rvIWl9E1XNpYvkU/TkcU2GYW7duoXeNjY2qlQq/H/gpqamefPmecQ0keS65+WAWq1GCVmwYEFtba1H+N/pXs8qGQHxdt/04UU3MpDyzN/rI7p+PtG60M4IRD+lPLmVHhcle1zkblRB7CMpDhNtCR0rcSRLiVFIxl8oFiHfhE52bh3RM5ToraxgueCND4RGTnd3d0xMDMUZYEKQ9/8Youo+I6z17aVqLksSXIqevEajmT59OnptNBpDQ0OxYH5UVBR6NkjRDx+LewzDzJkzZ8GCBXV1dUlJSUjhg1KZ7zlfvF2WPrysjQx8gK6fT7RO3BlByE8hfI5LtPvkblQhZVcCIYeJtihIGclSYhQKR2IsXi4RT3aM6BlKuSxICZaROXiioqKamppE4wLGGf/8B5Oo9e1yuaRUozSrqJ48Hx8Uy9FyWWdnZ2Zmpqz9YMbugNJq/3SJeCHr/J0R5Prpc1wSszf2jSq8oDjsd1sTKKpPhH6GSrwsUJA1GKZOnRoZGelbIIBy+GeOiYyMDAkJGRgYePLJJ3FhV1eXlGp0Fi5cuHDhQoZhTCaT2Wz2YY4xGAyBgYF//fUX+nJ3/vx5/MVq7O5lZ2dXVlZ2dHQUFxejkvDw8KGhoTt37qDvgDabTbqr0h24fv263W5/55130FvuVz+n03nlyhX0lb+jo+N///ufdAe4PPLIIwaD4aeffjp16tThw4clWjeZTHl5eQcPHnz22We1Wi2lpt/jEs3e9OnTw8PD//zzzyeeeAIXSh8eshwm2ho7ojGOMRwfoJyhEi8LQsgdPMDkRPxLkE6nczqdFy9epFfLzc1dv379mTNnenp6du/evX379rFUYxjm3LlzL7744s8//3zjxo0rV65UVVUlJSWJestn6tSpq1evLioqunLlypkzZ8rLy3NycsYYBeaxxx6LiIhob283m82oRKvVpqSkFBcXX7t27eLFi/hJaXh4uNPpvHDhAuW3atId0Ov14eHhn3/+ucPhuHjxYnl5OffT4uLiq1evomCxY6Ju8Ds6Ozu7uLg4PT3d65c8FOtBQUGZmZllZWVIy4TuJ98luXF5hSOavaKiovz8/NOnT1+9enXDhg2//PKLrOHBTxTFYb4tYpLlQo/Rh3CIcUlByhkq94TiIjp4+IN5eHhYevvAOCHloQ0S696zZw9Fcpyv9U18vCkqko+PouvJe4SfrvPfUvTD5brHp6SkBO9FhhASG9+0aZNv+xcQXZW1kQG3BewGv2UvVXaKfj7ROsJrZwQpuv1cl+Ru0MA9VrT75G5UQewjr0QJpYJoi59kUVuiJ5pXjPxwJO6w4JGwxQa3XPQMJXorK1jRjQ8ogxmYJPhT2x94wAD9fAAAxshk/J8/MEkA/XwAAMYIzDEAGSQRv3Llyol2BACA+xiYYwAyoJ8PAMDYUXCOEVUW8k16aHh4+OWXX/Y68MaNG6+++qper4+Ojt68efO9e/fo5YgXX3zxiy++wG+vX7++YsWKsLCwKVOmTJkyJTIy8q233lL0lyrcDEw2Iabh4eGjR4+C/iAAAGNBwTlGCRXu4eHhzMzMkZERr/LXXnvN7XazLHvixImTJ09u27aNXs4wzIULF1pbW7nf0/Pz810uF8uyTqfT6XSePHmyvb29oqLCvyFwAaFyAAAecCbwN20+/Naws7Pz/fff9zpwcHBQpVJxFZDi4uIo5Yj169dv3boVv3W5XAEBAX19fVxzp06dSkxMlBmWj8AvLwEAePAQuY+RqCpPFHXny4ALabYzDHPmzJmZM2ei/6mhA3fv3s0Xcp8zZ86WLVu8nOzv7w8JCeEqIPX19VHKGYZxOByHDh3iyrj29vYGBgbq9XqGYX799deHH344LCysrq4O/1G/p6fnpZde0mq1sbGxe/bsQb+2Gh+hct8U6UX9AQAAUBrxtTIpqvJEUXevdigy3Q6HIzs7u6Ki4umnn8ZGm5ub5QrUS2f//v1ms3nWrFm4xO12Y+knFFFHR0drayuW4SsoKAgMDLx06ZLVaj148CA3P0oLlctVpJfoDwAAgOLQb3MkqsoTRd1FJdBxBZPJtH79ei+jfCF3bgUhgXqPwH+SPf/+C/HcuXNZluWW4MpDQ0MqlQr9K/vEiROowsjIiFqtxv+prqmpwSYYZYTKuchVpPfBHwAAACUQv48hqso/99xz0dHRer0+NTXV6XRiUXeGYWpqaoh/quAfhcq3bNlSX1+fkpLCrewvgXoiP/zwQ0xMjJBY4cDAQGBg4MyZMxmGMRqNqLCvr8/tdnMl03F9WULlxAzQ8UGRXqI/AAAASuPL78osFsvixYsbGhpYlq2rq0OFaLns5s2bzc3NWVlZEo8aGhqqqak5dOjQpk2b+Pu/KsTevXuLioqEPuUumoludiILYgYk4neVeAAAgHFA9hyDBbcffvjh6OhovLuqyWRiWRaLuks8SqVS1dTUrFixIjU1devWrbg+EnJHr0UF6nU63dDQEJ6ibDabwWCglJ88eXLt2rV6vT45Ofn27dt6vV6v16tUKjSjIDHXmzdvMgyD758MBoNKpcKy5OfPn/dX3kTBKvHcQizhjv1RWsIdAADAB2TPMUKC216i7hKPUqvVjz76KMMwlZWV+/fvP336ND6EIlDvxbRp055//vmCgoKenh4kp48W64TKbTZbW1sbupnQaDQsy7Isq9PpXC7XH3/8MW3atPT09IqKip6enqqqKmRi6tSpZrO5qKioq6sLueSvvGG8hMq5//30iyI9AADA+OPLWtmRI0e+/vrriIiIxYsXz507F5evXLnS7XYLzQdCRyHmz5+fn5+Pf2ql0WhSUlKSk5PT09MTExNLSkroLh08eNDtdickJGRkZKSnp5eVlVHKo/8hIiJCpVKh18HBwYWFhV9++SXDMPv27auvr4+Pj09ISMAmqqqqRkZGEhISzGazbxd0ega0Wu3bb7+dnJz87bffdnV16XQ6/FFJSUlGRsaSJUvmzZtns9ni4+MZhvn4448jIiKSk5MzMzOzsrLWr1/vg0sAAACKMhm1/bu6uhISEu7cuTP+pkdHR6U8+bhw4cLixYuvXbs2Di4BAADcv4Am5r+Q+GidZVn+jQgAAADgRcBEO3DfsH379qioqKysrMuXL5eWluLlOAAAAEAIuI+RSkZGRnV1tdFozM3NLSwsXLNmzUR7BAAAMNmZjM9jAAAAgAcDuI8BAAAAlALmGAAAAEApYI4BAAAAlALmGAAAAEApYI4BAAAAlALmGAAAAEApYI4BAAAAlALmGAAAAEApYI4BAAAAlALmGAAAAEApYI4BAAAAlALmGAAAAEApYI4BAAAAlALmGAAAAEApYI4BAAAAlALmGAAAAEApYI4BAAAAlALmGAAAAEApYI4BAAAAlALmGAAAAEAp/g8hP5ehAs9f1wAAAABJRU5ErkJggg==)

Screenshot: ca.webd.top  vulnerability

Mirror: Click here to view the mirror

Coordinated Disclosure Timeline

Vulnerability Reported: 13 March, 2020 13:59 GMT
Vulnerability Verified: 13 March, 2020 14:07 GMT
Website Operator Notified: 13 March, 2020 14:07 GMT
a. Using the ISO 29147 guidelines
b. Using publicly available security contacts
c. Using Open Bug Bounty notification framework
d. Using security contacts provided by the researcher
Public Report Published
[without any technical details]: 13 March, 2020 14:07 GMT
Public Disclosure: A security researcher can delete the report before public disclosure, afterwards the report cannot be deleted or modified anymore. The researcher can also postpone public disclosure date as long as reasonably required to remediate the vulnerability. 11 June, 2020 13:59 GMT