Lucene search

K
openbugbountyMominroaimOBB:1127048
HistoryMar 28, 2020 - 9:28 p.m.

mulphico.pk Cross Site Scripting vulnerability

2020-03-2821:28:00
mominroaim
www.openbugbounty.org
5

Open Bug Bounty ID: OBB-1127048

Security Researcher mominroaim Helped patch 67 vulnerabilities
Received 2 Coordinated Disclosure badges
Received 5 recommendations , a holder of 2 badges for responsible and coordinated disclosure, found a security vulnerability affectingmulphico.pk
website and its users.

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:

&nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence;
&nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence.

Affected Website: mulphico.pk
Open Bug Bounty Program: Create your bounty program now. It’s open and free.
Vulnerable Application: Custom Code
Vulnerability Type: XSS (Cross Site Scripting) / CWE-79
CVSSv3 Score: 6.1 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N]
Disclosure Standard: Coordinated Disclosure based on ISO 29147 guidelines
Discovered and Reported by: **mominroaim Helped patch 67 vulnerabilities
Received 2 Coordinated Disclosure badges
Received 5 recommendations **
Remediation Guide: OWASP XSS Prevention Cheat Sheet
Export Vulnerability Data: Bugzilla Vulnerability Data
JIRA Vulnerability Data [ Configuration ]
Mantis Vulnerability Data
Splunk Vulnerability Data
XML Vulnerability Data [ XSD ]

Vulnerable URL:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAAAjCAIAAADNIk3yAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAOV0lEQVR4nO2cbUxb1RvAL6WUu1JeVtoOKHOFKS64IOKsqMCHzZhlWUh9Yb4ENzYJsoUhIaiFoCImjCBbNrYQPswFzZx8WMgkBqciMbUhCEi6WrFr2Oy6esUNGGBXKyve/4fj/3hz33rXrQPd8/vU8/a8nPvc+3DPuYcomqYJAAAAAIgAsuU2AAAAAPjPAjkGAAAAiBSQYwAAAIBIATkGAAAAiBSQYwAAAIBIATkGAAAAiBQrIsdkZGScO3dOqHi3cZe7f8c4d+7c3r17l9sK4G9u3Ljx4osv/vbbbxL7w23yb2H5c8wPP/zw119/Pfjgg7zFu4273P07SVlZmcFgWG4rgL+JiYlRKBR1dXVSOsNt8i8iRI65dOlSfHw8b9P8/PyBAweEitLp6+srLi4WKoaHiNlS+kgZHh4hJWP3r127tnv3bq1Wq9fr33zzzRs3boSn6NKlS6tXr74Vm8NAygSGHTBhXx2mxpmZGbvdXlNTwxV49OjR9evXx8bGPvTQQ59//jlLddT/iY6OzsjIeO+995aWllhNmCNHjqCm6Ojob7/9liUKXxfW2LVr19bX1+MrzvWXdU2PHj2akZERFxf36KOPfv3117zWcsWG9FREaUiPuFMRFRX1008/4c4ff/zx/fffv7S0xFRUU1MzMDBASOCOPSXCjlLgH2hR3G63SqWS0iTSUxyj0fjll18KFcNDijHifQKBwC3aEIZSmuF+cXHxSy+95PV6nU5nQUGB2WwOT5Hb7U5KSroVm8Mj5ASGHTC3ZaDQ746ODoPBMDAwcOXKlVOnTqnVaovFwpIQCAQCgYDf77fZbEajsbm5mdWECQaDqIkgiMzMTJ/PxxSFrwtLrMPhePzxxxsbG4X8ZY7t6OjIzMwcHBycnp4+ffq0RqOxWq1SxErxVEhpSI+QUqfTmZSUhH7v379/586duHNOTk53d7fIhRDntjwl6EhGKYBZ5hxDUVRSUtLi4iJvMWxuPcdECHGl2H2/35+eno5v4JGRkXvvvfemFHm93ry8PPTDaDTeis0RYuXkGDxXNE2npaUNDg7iIYcPH96+fbuIaqvVmp2dLW6V2+1WKpV5eXmVlZXMSlaOYQ4ZGhrasGGDUCtzLMvgrq4ubLC42Jv1lGWwuEfcGoqiVCqV2+2mabq/vz8zMxMlYObkS7yyt+spIQXIMbeOpP2YI0eOZGRkJCcnv/zyy/Pz8wRBzM/PGwwGn88XFRX14YcfMouHDh2Kj49///3316xZs3r16l27dv3xxx9Ckvv6+p566qmYmBhWEb3GHjx4EC0CPP/88zMzM6+//rpWq01OTt69e/f169cJztsu77oQ6iNkD9c1ltilpaX6+vo1a9bExcWVlJTMzMyg+uvXr7/66qtarXbt2rXvvvsuWjCRqBTx448/JicnMxccsPurVq26fPlyXFwcqp+cnExLSyMIYnR0tLCwMD4+Xq/XP/vss8zFBxZ6vf77779HP7777jtU+cUXXwj153bg1cU7G8jZAwcOaLXa1NTUDz74gLlSxzsPrPgRsm10dPSxxx5btWqVVqstKSn55ZdfuH3+/PPPV155JT4+ft26de+88w5euWKZxNXInav5+XmKogoKCnBTUVHRxMSEyIyRJBkMBsVnlSAImUz20UcfdXd3f/XVVyE7EwShUCgWFxdDduMavGfPnmPHjoUUG4anLG7Wo9TU1LKysra2NoIgWltbzWZzdHQ0wZh8cZjhwXxorIQoBcQJnWN8Pp/NZhsaGhoZGaEoymw2EwSRmJjodDrRm3hpaSmz+PTTT/t8vpGRkbGxsbGxsfHxcRRYvIhsxiC9VqvVZrNRFLVhw4bp6Wm73T48POx2uxsaGqQ7KWQPr2ss2traBgYGBgYGXC5XWloavg+rq6spihofHz979mxfX19nZ6dEpYj5+flnnnmmtbW1sLBQaDYQ58+fr6ura29vJwhi+/btZWVlHo/HarUWFBSQJIn6aDnwzkNZWdmWLVt4b+nR0dEtW7aUlZXhGl5dQrPh8/mcTqfD4eju7mY+uYTmgRU/QraNj49XVFRMTU05HI709PSqqiqu5c3NzX6/3263nz171mKxdHV18ZrE1cjF5/ORJIn/4iEIIiEhYWFhgbczQRBXr15tbGw0mUxCHZg88MADTU1Ne/bswX/KCHHt2rW33367vLw8pEyuwTExMevWrQsp9mY95UW6Rwiz2Xzq1KlPP/3U7XYzI00cbmQyb5OVEKVACMRfc9DC68LCAioODQ1lZmbiJt61MjTE4/Gg+t7e3k2bNqHfHo/HYDDgIT6fT6VSzc7OcotIyNzcHGqyWq0ymczv92Mz0NoR1wb0bs5aFeG1R6JrOp1ufHycNS3BYFClUl28eBEV+/r68vPzufPGqxRJ3rZt2759+5hDWLOB8Hq9mZmZPT09NE3Pzs7K5XLeFWQvB24fpKKlpUWtVu/YscPlcqFKl8u1Y8cOtVrd0tKCV+eEdPHOBnKWabmUYGBdO17bmExOTqakpHAHajQabDbaIOE1ieZEBXcNhFt58eJF5voPEqvRaDQajVqtJkmysrISzRKzCVFVVcUSGwwG8/Pz0bYEd3sDi5XJZFu3bhWxijfO6+rqkARmGAuJleKp+FqZuEfcIYjKykqSJDs7O2k+WEp5I5N5m6zAKAW43Nx+jMgiMvOCkSSJ6ycmJnQ6HfodDAYpisJNvb29mzdv5i2K6KUF7jGheiF7pLg2Nzcnl8vRwjETiqIUCgUuulwu9PhjShNR2tDQIJPJTpw4wRzCmg1Efn5+R0cHLr7wwgu5ubm1tbXt7e3ffPMNHRazs7Mmk0kul6OiXC43mUw4nYvoEpoN3udRyGDgfcqzbBsfH3/yySfT0tLQU5J7cWdnZ5lPdrVazXtxuRp5O3i9Xqa1NE1PTk5qNBqmBKVSibI4RVHMqWA2IfDjjKnL5XIplcozZ85wtzfwQIvFkpeXd/jwYZHpRWOZBs/NzXm93uHhYSlipXgqJccIecQdgrDb7SRJCu20s5TyRibrNlkJUQqIc0fPx0RHR6empuJiJL5ajgRo4fh24ff7e3t7e3p6zGYzc5GB6/6vv/5qt9v379+Paz755JPjx4/n5OQsLi7W1tbiJolrZQRBXLhwoaqqymKxNDc3o5rm5maLxbJv374LFy4wewrpur2zIW6byWQqKiqyWCw2m62/v587JBAIyGSysbExm81ms9nsdrvNZgvbALQqwvy6d2FhISEhgdlHJpPp9Xq9Xp+amsqaCtyE4P1k/L777mtpaamoqJienhYaW1hY2NHRgVdflUplIBBgbvj5fD6lUskyODExUa/XKxQK1CQuNqSnIkolesRLQkKCXC6PjY0N2ZMQiEzWbbISohQQJyI5JhAIXL58Gf12uVz33HMPt8/S0tJnn32Gw4VVlIharfb7/b///jsqer3esO3hJTExUa1Wc48T63Q6hULx888/o6LT6eSe5hNSKpPJent7S0pKjEZjY2MjquR1X6fTORwOltiHH354165d9fX1J06cOHPmDKq0ceB1Z+/evbm5uSkpKS6Xq76+HlXW19e7XC6dTpebm8s6987SJTQb4kicfK5tV69epSjqrbfeWr9+vV6vx5tPTFJTU5VK5ezsLH6SMv+IuVkSExPT0tKsViuuQZ+NhS2Ql9deey07O5t3bwmD/hJHv7VarVqtHh4exq0WiyUnJwcbPDQ0hJsGBwdRk7jYkJ6KKA3PozDgRibvbbK8UQqERvw1R2RByefzyeVyvCiJi2hx87nnnvN6vQ6HIzc3t6mpCUvAr8kWi2Xjxo24nlWUuFZG07TRaCwvL5+amnK5XAUFBah+YWFBLpc7nc5gMChkj8RlwJaWFqPRaLfbvV4v+vsF1ZeXlxcXF3s8HofDkZeXh1a0sHdSlDqdTpIk7XY7133udNE0PTExsXXrVnQSwuPxlJeXMz82lUJpaSn6eJQXt9tdWloqrot3NsRXIYSCgRU/vLbpdLrOzs65uTmXy2UymbgXl6bpysrK/Px8h8NBUVRbWxvztApLGlOjx+NhLRYh8KmR6enpnp6ekKdGWE1C52O4mx8qlYr3fEwgEJiYmCgqKmJu1x07diwrK8tisaBDMGq1Gh+Cwedjrly5cvLkSbVaPTQ0JEWsuKfiSkN6hLtxa0Q+BZ6cnOQ9y4Ujk3WbrJAoBcQJP8fQNN3U1KRUKtFZKlw8ePCgSqVqbW3V6XRJSUk7d+7Ee/WsLcqGhgYsilWUnmMmJyc3b96sUqmys7M7OjpwvdlsRrYhUVx7JOaYYDD4xhtvaDQakiRNJtP09DSq9/l8FRUVGo0mPT29qakJJTPWcn9IpdXV1UVFRVz3eb1eXFxsamrKyspSKBQ6na60tHRqaoqODEK6eGdD/O4VCgaaEz9cLBbLpk2bSJJMSUmpra3lXlyapgOBQE1NTXp6ulKp3LZtG/oQQ+hZhjUGAgGSJHm3bdFTW6FQ5Obm9vf38/rFBT2nWKDND95RXV1drD1/jE6nq6iowF+jIA4dOmQwGBQKxcaNG3t7e1kGo6a8vDzmkZeQYkU8FVca0iPc7aZyzOnTp3NycoRaac5tskKiFBAnRI4JA/EwwmRlZQ0PDwsV77w9y6s0cu4vL8sy+RKprq7mfmQBLBeBQMBgMBw/flykT4Ruk5Ucpf8B5Ld98U0i58+fFynebdzl7i8L7e3tt/KBAHB7iY2NPXny5BNPPCHSB26TfyPL/3+XAWBZiImJeeSRR5bbCuAfxBMM8C8FcgwAAAAQKaJoml5uGwAAAID/JvAeAwAAAEQKyDEAAABApIAcAwAAAEQKyDEAAABApIAcAwAAAEQKyDEAAABApIAcAwAAAEQKyDEAAABApIAcAwAAAEQKyDEAAABApPgf7zXbJAhwtSkAAAAASUVORK5CYII=)

HTTP POST data:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAABLCAIAAAAphcDFAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAZwklEQVR4nO2dcVBUxx3Hn8d5HHAceMJFAStgQhybUmotJSmxjnHUUoa5UqOppYFQhhIG7Q1jUzDWUkwJNWcakVL/IB3qGON0HIcyGWIsSTNXhhol9EKQXE4kgMdh8ATOXugVkdc/ttl5vre7793JCcLv89ext7u/3+7b937cvve+vyU8z3MAAAAAEARUc+0AAAAAsGCBGAMAAAAEC4gxAAAAQLCAGAMAAAAEC4gxAAAAQLCAGAMAAAAEC4gxAAAAQLCAGAMAAAAEC/kYMzg4uETAqlWrKisrb9++fR+cI+LxeF5++eW5si5icHAwMjJyrr0AAACYpyj6HaPT6Xw+n8/nm5ycbG1tff/996urq4PtGY2JiYmampq5sg4AAAAoR+leWWhoaGhoaFhY2Ne+9jWLxXLmzJmgugUAAAAsAAK5H6PVan0+H8dx//3vf3/6059GRkauXr3617/+9Z07d1CF4eHhbdu2RURErFmz5ve///2yZcs4ybbS4OAgKmf0c+nSpSeffDIyMjI+Pv6HP/zhJ5984vF4EhMTvV7vkiVL/vznP9M8lDZkGLp06dLjjz8eFhYWGxv79NNPDw8PY29ffvnl2NjYlStXvv766xzH3blzp7Ky8qGHHoqIiHj66adv3ryJuj169GhSUtLy5ct/8pOfeDyeAKYUAABgQeJ3jPF4PFVVVVlZWRzHVVdXT05Odnd3nzt3zmq1Hj9+HNUpKyvT6/V2u/38+fNNTU2yfdL6yc7OLigoGBoaam9vz8zM1Gq1UVFRdrsd7d3l5eVxHBcrgdiQYairq6u4uPj69es9PT0JCQllZWWostfrtdvtPT09TU1NmZmZHMcdPny4ra2tra3N4XDExcX19vaiajabraOj4+LFiy6Xq6Kiwt8pBQAAWLDwcgwMDHAcF/MlGo1m9+7dXq+X5/mYmBj0ged5m82Wnp7O8/z09LRWqx0aGkLlZ8+ejY6ORv3odDpht6ic1s/Y2Jharfb5fFJ/hP04JdAa0gwJ6evrW7FiBR712NiY8Fuj0djV1SWdnFu3bqE/Ozo6kpOTqVMJAACwyFAriUPh4eE2m43juLa2toqKisbGxrCwsPHxcbfbnZiYiOrMzMyo1WqO40ZHRzmOW7VqFSpfu3Ytu3NaP8uWLduxY0dGRsbmzZvj4uI2bNjw3e9+V9o8Pj5eWkhsSDP0r3/964UXXujt7Z2ampqZmZmZmUEVdDod3s3jOM7j8YyNjaWmpops6XQ6vAcYFxc3NjbGHi8AAMDiQVGMUalU6FKen59vsVgaGxv37Nnj8/lUKlVnZye6UqNqAXjA6OfNN9/88MMPe3p6XC5XeXn5E088cezYMVFztDkm5MaNG8SGNEMmk6moqOj48eNardbpdG7fvp3hbUhISABjBAAAWKTI/tIR7U2dPn06ISEB7UTpdDrR3hEv2Strbm5Ge2K3bt1SqVR4W6m9vR3vlRH7EWGz2RISEqT+SPfKaA2JhkZHR9VqtbAycWcPYTQabTYbY3KEG4AAAACA3788du3apdfr0Z38vLy80tLSy5cvj4yMvPLKK4cOHeI4LiQkZPv27eXl5cPDw5cvX66qqkINIyMjN2zYUF5e/vnnn1+5ckV4b5zYzyeffPK9733v73//+82bN69du1ZfX5+WlsZxXExMjM/nu3LlCmobL4HWkGgoNjbWYDD88Y9/9Hg8V65cwd4SMZvNxcXFH3/88fDw8J49e/7xj3/4O3sAAACLC9koJP2P/uTJk4mJiVNTUz6fz2w2JyQkhIeHZ2Vl9ff3owpOp3Pr1q3h4eHJyckWiwX/a9/X17d582adTrdu3bq6ujpcTuxnamqqqqoqJSVFo9EYjca8vLzr16+j+lVVVeHh4U1NTUSHGQ2JhqxW64YNG7Ra7YoVK8rLyxm/Y6anp1944YWYmBitVmsymdxuN/yOAQAAYLCE5/mgxrDBwcG0tLTx8fGgWgEAAADmIaCJCQAAAAQLiDFUkpKSPvroI3bJomKRD/++8dFHHz3//PNz7QXwf27fvv2jH/3o888/V1gfThMREGPIfPzxxzMzM1//+tcZJYuKRT78+0lBQQF+iwuYc5YuXarRaPbt26ekMpwmUoIeY1avXj0+Pj67Gvjs3kTi/4HlAmhpacnJyWGXBICSeWDUCV4qAdme8fDHx8efe+652NjY+Pj4X/7yl/5mecCGhIJ19w0lExhw8oiAj47Q4s2bN7u7u81ms7TDY8eOrVmzJjQ09Bvf+Mbbb78tMo2zb4SEhCQlJR06dAjJ8YlycyCOHj2KvgoJCRE9Hik8Luy8HtLxio7psWPHkpKSIiIivv3tb7/77rtEb4npQtgjZRhlj0g6D0uWLImMjMR6hhzHvfHGG48++uhnn30mtGI2m9va2jgFzMpVYqFx354uIIq7BAbxoS/at+zKNNLT08+fP88uCQAlzrDrzOI0KjfKC4afk5Oze/dup9Npt9szMzMrKioCMzRXz+DJTmBgC2a2GtI+19XVJSYmtrW1jY6Onjp1ymAwWK1WUQ84AQfSSaqurhZ9hZmenua/VEJKTk7GAkv83cdF1G1PT88TTzxx4MAB2niFbevq6pKTk9977z23233mzJmYmJj29nYl3SoZKc0oe0TIot1uj46OxlNhNpufffZZXDk1NbWpqSnga8isXCUWGPcvxswiwY4xLpcrOjp6amqKURIY9x5jggTbKB7+5ORkQkICPoEvXrz48MMP+2XI6XSuX78efZDqxc0H5k+MwXPF83xcXNx7772Hm7z22mvZ2dkM0+3t7evWrWN7NTAwEB4evn79+pKSEmGhKMYIm3R0dKxdu5b2rbCtyOHjx49jh9nd+jtSkcPsEUn/dLlcOp1uYGCA5/nW1tbk5OTp6WnhzBONEpmtq8QCQ36vTKqHj36uHjlyJCkpadmyZT/+8Y+FgvYjIyPf//73IyMjk5KSjhw5IhL2Z7SlKfzTICrqi8T/hX+++uqrkZGRr7zyykMPPbRs2bL8/Pz//Oc/xJ5bWlq2bt26dOlSaYnQ/4iIiF27dt28efMXv/hFbGzs8uXLn3vuuS+++IJjJjIQFjL8IY5O2C0t0cAXX3zxs5/9LDY2dtWqVb/5zW9E08g2irh8+fLy5cuFGw54+GFhYdeuXYuIiEDlfX19cXFxHD2ZgpT4+PgPP/wQffjggw9Q4TvvvEOrL61AtCWdDWJ2BtE6lM6DNHkE0TdiPggRxPUs9YqRrgLPlcfjcblcSPwbsXHjRiT7TUOr1U5PT7NnleM4lUp14sSJpqamv/3tb7KVOY7TaDRTU1Oy1aQOFxYW1tfXy3YbwEhF+DuilStXFhQUHD58mOO42traioqKkJAQPPNsRGtDeN1QuEqVj+vBRT7GEPXwvV5vd3c3ErQfGhrav38/rl9WVqbRaPr6+tra2k6cOCHtkNaWpvBPVO+nKeqLxP+Ff/7gBz/wer0XL17s7Ozs7Ozs6upCC0sK+2YMMt3e3m6z2Vwu19q1a91ud3d394ULFwYGBoRTIQvNHyX5AoiJBjiO27t3r8vl6urqOnfuXEtLS0NDg0KjCI/Hk5ubW1tb++STTzImhOO4Tz/9dN++fRaLhaMnUyAeOykFBQVPPfUU8ay+dOnSU089VVBQgEuItmhpF0TZGWTnQZo8gugbLR+EENp6FnkltSjF6/VqtVrhPz16vf7WrVvEyhzH3bhx48CBAyaTiVZByFe/+tWqqqrCwkLZ1Efj4+MHDx4sKiqS7VPq8NKlS1evXi3brb8jJaJ8RIiKiopTp0799a9/HRgYEK40BtJlyd19mihfpQsf2V86Uj18kaB9e3s7FrRHYmX4hX+psD+jLU14X6pIxlbUp+2VoVbCpAMbNmxAn4eGhhITE9Fnr9er0+mEqv7CEtTJxMQE9l+lUk1OTmJP0N4R7f1/0a4I0R/G6ITNpYkG0PzrdDo8/y0tLRkZGcIKDKOo56ysrNLSUmET6YTwPO90OpOTk0+fPs3TszDwCtTksImamhqDwbBz506Hw4EKHQ7Hzp07DQZDTU0NXhg0W7S0CyK3lSwG0bEj+iZEmA9C2JC4ntleSTuhFfb394v2f7gvE3AYDAatVltSUoJmSZSbIyYmpqysTNTt9PR0RkYGui0hvb2Bu1WpVNu3b2d4RVzn+/btQz0IlzGtWyUjZe+VsUck/RNRUlKi1WobGhp4EkKjxGXJ332aKF+liwEZ3WWaHr5Q0D4hIQEL2o+Ojs7MzCQlJaE/icL+xLY0QxxJvX9wcDAwRX2tVitMOjA0NIR76OjoQJ/Pnz+fnp4u3NoSleh0uqioKOy/Xq8PCwvD/bjdbiWesP2RHR0t0cDo6OjU1JRw/tH5rMQox3EvvvjiuXPnGhsbhfWlE8Jx3I4dO8xm865duzhmFgZi5gUpERERlZWVJSUlhYWF69atQ48YrVu3Ljs7u7+/H882zRYj7QLj0TXGPMj6RssHgWGsZ7ZXRNRqtWjjS9ghAifgUKlURqNRKBCOv8J/ivoPCQk5ceJEWlpabm4uFveTtu3v7zebzUePHv35z3+u3OEDBw6YzWaRojmtWyUjVQJjRERKS0ubmpoKCwtlaxKXJXf3aeLXKl3wyBw8oh6+kg1Zf2Eo/Es3WDo7O2fXekhIyMqVK9HnID21HAxmN9HA5OTk2bNnT58+XVZWlpubi08h6fBHRka6u7v/+c9/4hJaFgZi5gWi9atXrx48eNBqtVZXV6OS6upqi8VSWlpaXV29Zs0ahq2XXnqJC2baBalvsvkgZivzBQLtpN2+fRtvIt26dUuv1wvr4AQcUhhfYR555JGampri4uLW1lZa2/j4+Lq6usLCQhRjwsPDfT7fnTt38Mx7vV4UwIQOR0VFRUVFjY6OCmMbrVvZkTKMKhwREb1er1arQ0NDZWvSlqXoNLn/q3T+IvtLR6qHzxCCRHtl6CENnrJXRmtLU/gn7pUxlCgV7pU1Nzfj7RHM9PR0TEwM3muSlsiaZicyYOyVYX8YJkR7ZaJEA7z/e2VCo2q1ure3l+f57OxsvJ0inRBUKCoRIkymoHCvrKSkRKfTlZeXu91uYbnb7TabzTqdTviYENGWbNoFUSFjMYgaSn1TmA+CuJ5lt8JojzCJnraqq6tjP20V2FebNm3KyMhgPFd24cIF4b600WjETyTzPN/Q0IB3veLi4t5//338lcViYWyICbtlj5RtVHZEPGWvzK9HVaXLkniaYBirdDEgH2NKSkoyMjJQQD58+HB1dTX7Ortjxw6TyTQwMNDT05Oamqo8xkgN0VxiO+D1etVqNd46x3+iy8qOHTucTmdPT09aWlpVVRVuhTZPrVbrY489JrQlKlEYY3ieT09PLyoqun79usPhyMzMxLFHrVbb7fbp6WmaPwpjTE1NTXp6end3t9PpLCsrw+8QFBUV5eTkDA0N9fT0rF+/vq6ujhe8FKLEqN1u12q13d3dxAkRTheit7d3+/bt6E2IoaGhoqIi0UVBlry8PPx/iZSBgYG8vDy2LelsKIkxxMUgWj9E34xGY0NDw8TEhMPhMJlM0oPLU9Yz0SuhxaGhIa1WK50E/NaI2+0+ffq07Fsjoq9o78dIb37odDri+zE+n6+3t3fjxo3C23X19fUpKSlWqxW9BGMwGPDVH78fMzo6evLkSYPB0NHRoaRb9kjZRmVHxAcUY/r6+ohN8LIUnSbKVynN4kJCPsZI9fDZ19nr169nZ2frdLrExMTa2lrlMYaWKUAK2wFeIv6P/jxy5IhOp6utrTUajdHR0c8++yy+V4873Ldv3/79+4VdiUqUxxhaIoOKigrkG+pK6o/CGCNNNIDKvV5vcXFxTExMQkJCVVUVCmaif5Nlje7du3fjxo3ECZGOmpFMYdah2ZJNuyAcPk+fBwQ7eQRPyQfBCw4uT1nPtGsZtujz+bRaLfHhAnTV1mg0aWlpra2txHFJkd6Q4zjutddeo7U6fvy46J4/xmg0FhcX41/niFdffTUxMVGj0Tz22GNnz54VOYy+Wr9+vfCniWy3jJGyjcqOiA8oxpw5cyY1NZX2LS85TZSvUkafC4bgvoNpt9uNRmNQTSiHvYwQKSkpFy5cYJfcT3/m3Gjwhj+3zMnkK2Tv3r2bN2+eay+A/+Pz+RITExsbGxl1FuppMiv4/cCGX9hstuTk5KCamF0+/fRT2ZJFxSIf/pxgsViEj4EBc0toaOjJkye/853vMOrAacJg9jUxDx069Prrr9+4ceODDz7Yv39/SUnJrJtYnIBmuHIeaHn8pUuXfutb35prL/6Pv8r2CxJ2gAHYzH6M2bRpU0NDQ0JCQl5e3t69e/Pz82fdxCIENMP9AuTxZwu/lO0BgIC/m2tKNrInJiZqamoC3b67TygZiPAW8ZyIBGNeeukl/DyxcmbrrsOcD18W4ZJzu90qlQq/5X7f7rvM4mwH22fZM1ToQ1dXFxIyAIAA8Pt3zOrVq2VfZUcrONCoBxCYt++BzhOESw69lKfkfbpFi19nqMFg8Hq9QfUHWMAEsle2eM5etVqdkpIi/DAnjIyMOByOTZs2zZUDDy5ze+AeXGDegNlCJsZIpchnSx2dBlETmyb7L5VYJyq6MyS1iRL6mHsUoieOZdeuXb/97W9x5ccffxzNEjEnAkKoGS6V7menWhBClP2nydQPDw9v27YtMjLy0UcfPXXqFHvItMVAPBzsIchmTFCy5KRHkDEDjHwH/ia24Djud7/7HXEShHOFDy7joEv7Yfsv7Z/mqmi6/vCHP2zbtg03f/HFF/Pz8xni9n6dzgAg/zuGIZB+L+roNNV3oiY2TSadKLEudZgmqa1EQl+KciF64lh27tzZ3NyMKoyMjNhsNqTBzsiJINwoI0r3M1ItCCG2pcnUl5WV6fX63t7e1tZWYYyhHThGngLR4aANQUnGBIVLjgYt8QHNeX8TW3i93s4vYSSPwNAOOq0f2cQNIoiuiqbLZDJZrdZ///vfqElLS0tubi6jT8b6BwAC7Ns1AxIpcprik7/q6EQlK5omNk32XwiSWJc6zFMktQeYCQIYKBSip41lcnJSr9ejeWtoaMjJyeHpORH4uzXDiXJkooEI0yWIdAHYUma8QKYe+SM8uNgf4oGjLQbp4WAMQUnGBCVLjnbPnDYDjG79SmzBmASicAMjEQaxH4b/xP4VLgye5zMyMs6cOYPLRYtWyekMADTkY4w0WwOOMUJhpd7eXvxKP/EkHxsbM5lMQjFBIs8880xaWlp5ebnFYkGaekjZHme/MBgM2FBXV9eWLVvi4uJQeXR0tNT0xMQEEgxnD83fR6dEw1Gr1SaTCV8laWPB5UhGbMuWLSdPnuR53uVyaTQaXKG3txc7c/bsWfzWt6iaw+FAYVWJ9gyxLU+aQ1RZdHDZk0NbDNLD4e8Q+LsvmkqWHC3G0GaA1i1x4bFnW8kk4Ca0g07rh+E/LcYoWRg8z9fW1hYUFPA8X19fv3PnTtG83cvpDACz/34MkatXryINOKyOTttyefPNNxsbG1NTU6empsrLy/fs2YNl0m02m81m6+7uxm9Bm0ymjRs3Wq1Wm83GVvCeXUlt6XCqq6utVmtpaenVq1dxNelYUDnaLhsfH7948aLs02LBfqJM+RwiFKa2XAAwFt4CIzc3Fx36t956i71RhpCufwCgcU8xxufzXbt2DX12OBxf+cpXiNWef/75tLS0FStWOByOyspKVGiTgOt/85vfzM/Pr6ys/NOf/tTc3Lxy5crw8PCxsbH4L0G5Xm7cuOFyuX71q1+tWbMmPj4e5/cVERUVZTAYZvENeeJwKisrHQ6H0WhMS0sTvmEuGgsqzMrKstlsJ06c2LJlC7pbazQaVSrV4OAgqmC329GHO3fuvPXWWzjGGI1GjUbz2Wef4WrK3zQktqXNodFo5DhOeHBxP7QDp3Ax3MsQlFvx1zSxW9rC89c9g8EwOTmJb3g4nU7sD/Gg0/qh+U/rXzmPPPKI0Wh89913L1y4kJWVxa5MXP8AQIX9M4e9V8bdgzo6EZomNk32XyqxTvxdT5TUDnivTKEQPVvxfvfu3Xq9/i9/+QsuIeZEkErrS6X7GQMRqc0TZf+JMvU8z5tMJuHBld0rIy4G4uHwawj83Zs/SpYcTR6fNgOMbv1KbMHoh5jogacnwqD1Q/Sf1j/DVdEZyvP8wYMHU1NTiUkZRMr2yk9nAODv8X7MvaijE6FpYtNk/6US68SLGlFS+x7vxwQ8FkRzc7NOpxPOGDEnglRany3dLx2IUG1e2pany9Q7nc6tW7fqdLqUlBSLxSIbY5SkDAhsCKIbDLJLjiGPT5wBRrd+JbZAXx0+fFjaDy3RAyMRBrEfov+0/tmzKjpD0e9R4gkrq2wPAAwC1/afz+roDzo4J8KDohl+fxaDcit+yePPk5U8t4kwvF6vVqsVPZDJK1O2BwAGwdX2BwID50QAzfDAeBDl8ec2Ecb58+czMzOFL4EilCjbAwADiDHzhUOHDsXFxeXk5PT39+/fv//gwYNz7dEDzLySx2cwTw66x+Opr69/5plniN9CgAHuhfv07DIgC+REWITMk4OOb/zMiXVgYbOE5/m59gEAAABYmMDvGAAAACBYQIwBAAAAggXEGAAAACBYQIwBAAAAggXEGAAAACBYQIwBAAAAggXEGAAAACBYQIwBAAAAggXEGAAAACBYQIwBAAAAggXEGAAAACBYQIwBAAAAggXEGAAAACBYQIwBAAAAggXEGAAAACBYQIwBAAAAggXEGAAAACBYQIwBAAAAggXEGAAAACBYQIwBAAAAgsX/AFJL8HjS+u8PAAAAAElFTkSuQmCC)

Research’s Comment:

![](data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAiEAAABfCAIAAACxwoBIAAAACXBIWXMAAA7EAAAOxAGVKw4bAAASjUlEQVR4nO3da0xT9xsH8GNBLXCqUEpBxL/UF0qIQWIIwwVR0XhhDekQcdmYko04JGhYsxioC+swQ4dzF8aYL1yCLJlk2QghZHGGjIQRXnhBxsrFigiVS2XAACurHXD+L052cnJ6Li1Qbn4/r9ofp895zu9X+3BO8TyrKIoiAAAAPEC22AkAAMCKhRoDAACeghoDAACeghoDAACeghoDAACeghoDAACeghpDaDSaP/74Y7GzAABYgV72GvPnn3/OzMzs2LFjsRMBAFiBlmKN6e3tVSgUntueraamJjk5eXavBQAAcUuxxiwk1BgAAM95qWvM4OCg2Wzeu3fvYicCALAySdSYx48f+/n53b9/nyCIkZGRgICA+vp6giDu3Lmze/duhUKxcePGo0ePdnR0CA0yOFe0ent7AwICmPGLFy8GBQVt2LDhu+++cz37X3/9lXn86aefBgcHBwQEnDx58p9//nElck1NzcGDB1evXu0cDQAA5k6ixmg0GoPBkJubSxBEQUFBUlLSvn37CILQarUZGRkWi6WxsTE+Pl4ulwsNusJms3V2dppMpvLy8vj4eFdecufOnf3792dkZDAR7v6nubm5uLjYlcicC2UZGRn79++/d++ei2kDAIAESorD4YiIiDAajSqVymq1UhQ1Ojrq7e1tt9vZm/EOsvX09JAkyX7q7+9PPyAIYnR0VGhLi8USHh7OPDWbzWlpaUqlsqioyGazMREsFgu9QVVVVUxMDG9kNpvNRpIk+6c2m62oqEipVKalpZnNZsmZAQAAcd6SRWj16tWlpaUHDhwoKSkJDg4mCCIgICA1NTUuLi4xMTE0NDQmJmbPnj28gy7WOZIk6etmvEJDQ5uampinkZGRWq22u7t7/fr1zKBcLt+0aRP9OCIiwmKxSEa+detWbGws+6d+fn75+flZWVnvvPNOZGTkv//+62L+AADAy6Xv/K1Wq0wms1qtzMiNGzeuXbsWFRXlcDj0ev2ZM2eEBufOy8trw4YNzNPCwsKGhobs7OxHjx7NJSzvX5Q9evQoJyenoaGhsLBwLsEBAIAgXLhWNjY2FhISUllZqVQq29vbnTdoaWkJCwuTHJyYmJDJZBMTE/TTxsZG5loZ+8oY7wjH8PBwbm4uSZJZWVmU07Wy6upq5lqZUJypqSmVStXd3c0ezMrKIklSr9cPDw+L7B0AAFwkfR5jMBgSEhKOHz+u1+uzs7MJgujo6Dhy5Eh9ff3IyMiTJ09KS0ujo6N5B9lxFApFTEyMXq9/+vTpw4cP8/LyhPaoVCrtdvuDBw+mp6fpkRcvXrA3CAwM/OKLL0wmk81mYwb1en1/f39bW5vRaNRqteIH1dTUFBISotFo2IM2m81kMl25ciUwMFByWgAAQJp4Cbp79y5JkvQpgt1uDw8Pr6iocDgcRqNx69ata9asUavV6enpVquVd5ATraurKzExkSTJyMjIkpISofMYiqLy8vJ8fX3Ly8uFNmCjNyguLlar1f7+/idOnJicnBR/4QcffGAwGMSPHQAA5mgVRVGLXeYWwbZt2yoqKl555ZXFTgQAYCV7SWsMAAAsgEW4lwzupQ8A8JJY6BqDe+kDALw8ZlNjcC99AABwxUKfx6DGAAC8PBa0xuBe+gAALxX3agzupQ8AAK5ztcbgXvoAAOA2yf+liXvpAwDA7Eifx0RGRjocju7u7vz8fD8/P3pwHu+l39XV5XA4IiMjZ10mAQBgaZKuMbiXPgAAzI50jcnPzzebzWq1Ojo6+vTp0/Sg3W5/8uQJ/dhsNv/vf/8TDzI9PV1bW8upMadPn46Ojg4JCTGbzfn5+bPKHwAAli6XvvPHvfQBAGAWpHstMzZv3vz999/Tj0mSjI2N3blzp8PhSE5OPnfunPhreS+UMdEAAGBFWqD7LuNe+gAALyHc2x8AADxlEe7tDwAALwnUGAAA8BTpGjM+Pn7x4kVC9Jb+rt/tfy59ARYFO2FmKojZHsiCHf5Sm+fe3l7n/5zLns9Zm0sQz82SUOSFXBfnOZ/L3pfaOwqWC+kaMzY2VlRUJL7N5s2bh4eHXdmf61suEeyE2VOx7A5kCXLlrbUwQRbM8n3bLN/MYXHN27WytWvXzvuWS4RQwsvuQGApWL5vm+WbOSwiiRozPj4eHh5us9lWrVr1888/EwTx1VdfaTSawMDAt99+e3x8nN6MfR59586d3bt3KxSKjRs3Hj16tKOjgx2Qc8YtsvHx48c/+eQT5umuXbuuX79OEMSLFy/effddhUKxefPmjz76aHp6muBrK/DNN98cOnSIefn58+dPnjzJzmR6ejo/Pz84ONjPz+/YsWMjIyO8cZiE2VNx/fp19oHwhqKPbteuXT4+PkFBQceOHevv7xeZateD0Lu+cuWKRqMJCAh46623mIXgcO6/IDSBQgvEud7Cu15CAfv7+w8dOqRQKLZt2/bDDz9wcuPMJ0EQz58/f++994KCgjZt2vTxxx9zEuPdu3MQoWTmZS14M5RMu62tLTAw8Pfff3eeXvG14E1bfPXF55xDKPPBwcHXXntNoVBoNJorV67QbwB25q68A4UmXPzzAVYeiRqzfv36zs5OkiTtdvvrr79us9laWlqamppu3749MDCQl5fn/BKtVpuRkWGxWBobG+Pj4+VyuUh8kY3T0tKqq6vpx4ODgy0tLTqdjiCIwsLCycnJ1tbWmzdvNjQ0XL16ld6G01ZAp9M1NDQ8e/aM/mlNTU1KSgp718XFxXV1dXV1dWazOTQ0tL29nTcO71Skp6e7Eqq5ufnUqVNWq9VkMoWFheXk5IhMhVtBbDZba2srvRAWi8VgMDgHFOq/IDSBruBdL6GAOTk569ata29v/+WXX5w/75zn8+zZswMDA83NzTdv3qypqSkrK5Pcu3MQoWTmZS14MxRPe3x8PCUl5dKlS7t373bekeRauLv64nPOIZR5Tk7OmjVrurq66urqKioqeF8r+Q4UmnC3Ph9gJZC8M3NPTw9JktR/t+6fmJigx5uamrZs2cLZZnR01Nvb2263S0aT3HhycnLdunV0B4GysrLk5GR6XKVS0S0GKIpqaWmJjY2lBNoKxMXF/fTTT8xOOTtSq9XNzc3O6XHisBMWeswbiqOrqyskJIT9Kg63grAXorGxkVkIzoE491+gBCaQ93jpp/7+/vRjofXiDTg1NSWXy9kJMHF49zU1NUWSZHd3N/20pqYmLi6OvbHQ3jkJix8djZ5G59cyeNeCN0OhtJnISUlJ2dnZc8mWk7bI6kvOuSsTTgdhxpkgnDe/5DvQOXPKhc8HWHncuJcMQRAkSTLny6GhoaOjo5wNAgICUlNT4+LiEhMTQ0NDY2Ji9uzZIxRNfGMfH5+kpKTq6uozZ85UVVXR7dH+/vvv4eHh8PBwepuZmRlvb28mN85f0eh0utra2qNHj9bW1iYlJbGvJo+Pj4+OjkZFRfEeo1B7Al4ioe7fv3/u3Ln29naHwzEzMzMzMzNfQdgLERYW5rwQhED/BZEJlMS7XkIBh4aGCIJgJyAefGhoyOFwMHe0i4iIoD/IxPfOCSJydHNfC94MxdM+f/78zZs3r127xrsjV9bCrdV3a86FMh8aGpqZmWGP875c8h3Im7lbnw+wMrhXY1xx48aNe/fumUymgYEBvV7/6quvfv3117PbOC0trbS0ND09/fbt21VVVQRB2O12mUx29+5d5l+jTCZ4uS8lJYW+2FVbW8t08GTz8vKa7VG6FEqn02VmZl69elUul/f19R0+fHgBgohzawKdOa+XwWCYS0C3SL61RI5uXtbCLZOTk1VVVZWVlTk5OSkpKevXr+ds4MpazO/qLyShzN36fICVQPJMh32tTOgqitA1h5aWlrCwMN5ormxst9uVSuWXX36ZkpLCDJIkyXuNizfs9u3b6+rq/P39mfN6hlqtbmlpkYzj4rUy51BDQ0Pe3t7so/P39xe/Vja7IOyFYA8SrGtl1dXVzLUy3glkTExMyGQy9mUQ5+BMMvR68QbkXLeprq6e47Uyob1zZoM3Gd5pdH4tg3ct3L1W5u3t3d7eTlGUVqvNyclxPmShbMXTFll9yTl3/VpZT08PPS50rUz8HSg04RzO/+Rh5ZGuMTabzdvb22w2u1Jj2tvbDx8+/Ntvvw0PD1sslszMTK1Wy47GDiK5MUVRb7755rp163788UdmJCsrKy4ujv49qLi4uLCwkBL+sCgoKIiKinIOS1FUUVFRbGxsa2trX18f3SeNNw57hJkKzjhvKIqi1Gp1WVnZ2NiY2WzW6XR0qfP29u7s7JyamnIlH94grteY1NTUvr4+k8kUHR1tNBpFJpAtNjY2MzPTarWazeb4+HgmuNB6CQXU6XTsBJyTZM8nRVGZmZnJyckWi8VkMu3cubOkpIS9sdDeOUGEknGeRoqihJZDaC14M+QdZK9RZ2enXC5vbW2lnN5gkmvh7uqLzznneIUmPDU1VafT9fT0mEymqKioWdQYoQl35Z88rDDSNYaiKKPR6Ovre+XKFcka43A4jEbj1q1b16xZo1ar09PTrVYrOxT73Sm5MUVR1dXVJElOTk4yI3a7PTc3NywszNfXNykpif5FTOREiiCI8vJy5x9NTU2dO3dOpVLJ5XKdTjc8PMwbhzNCT0V5eTnnV0LnUBRFNTQ0xMTEyOXykJAQvV5PT1deXh4dwZV8eIO4WGNIkiwuLlar1f7+/idOnGDmkHcC2bq6uhITE0mSjIyMLCkpYYILrZdQwL6+voMHD5IkuXXr1s8++4z3N1lmPimKstlsp06dUqlUYWFhRqOR87kv8m5hBxFKhncthJZDaC14M+Qd5KzR2bNnExISnMcl18Ld1Zecc/bxCk241WrVarUkSYaHh1+6dGl2NYZ3wl35Jw8rzAq/7/Lz589VKtXAwIBbX+MDAO3BgwcJCQlPnz5d7ERguVrh98S8detWfHw8CgzA7LS0tGzZsmWxs4BlbP7/rmzpGB8fLy0tfeONNxY7EYDl5MKFC6GhocnJyd3d3QaDoaCgYLEzgmVsJZ/HMF9FLHYiAMvJ3r17y8rKwsLC0tPTz549y7kJE4BbVvj3MQAAsIiWxHlMb2/vqv94eXlpNJoLFy5MT08vVsuK999/38fHh3PjSwAAcNdS+T6GJEm6O8XMzIzZbD516hRBEItymWtkZKSkpKS5uXn79u1eXl7omQEAMGtL4jyGtnbt2rVr1/r4+OzYsePzzz+vrKxclDRsNpuvr++OHTvou4mgZwYAwKxJ1BiRbiKutxJxbsoimZZcLp+amuIMutsaxK1mJ7SRkRHeJjGPHz/28/O7f/8+vU1AQEB9fT0nPd40hLplCPUFuXz5snPHFwCAZWr25zFutRIRasrC66+//vrwww/pbjFs7rYGcStDWmBgIG+TGI1GYzAYcnNzCYIoKChISkrat28fJz3eNIS6ZQj1Bbl9+7ZzxxcAgOVK/DYAQjeNcKuVCG9zF85eCIJQqVQqlUqpVMrl8qysLLvdPpfWIG5lKHTInDvfREREGI1GlUoleQMMOg0Xu2Ww+4LwdnwBAFimZvmdv1utRAgXmrL4+vrS9xaTyWRqtdr5zurutgZxN0NJq1evLi0tPXDgQElJSXBwsPMGzmmIdMvgzZm34wsAwPI1+78rm99WIjKZbOPGjSIbzKI1yLw3O7FarTKZzGq18v6UNw2hbhnLty8IAIAbxE9zXOwmIt5KRKRpivgGc2kN4laGQjtlPx4bGwsJCamsrFQqlXRfEHfTYHIQ6gtCCHR8AQBYpiR+i1coFDExMXq9/unTpw8fPszLy6PHOzo6jhw5Ul9fPzIy8uTJk9LS0ujoaIIg0tPTs7Oz29raBgcHL1++fOHCBaHIL168kKx/SqXSbrc/ePCA/usv3uBBQUFKpfLbb78dHx9/+PCh0Wicrww5DAZDQkLC8ePH9Xp9dnY256e8aQjlIJQzQRB6vb6/v7+trc1oNGq1WtfnCgBgKZKsQrzdRNxqJSLZlEXkRIfd7sKt1iDuNjvhTYZ5fPfuXZIk6ZMMu90eHh5eUVHBeaFzGiLdMoT6gly6dInT8UXyLBAAYMnC/cqWit7e3u3btz979myxEwEAmDdL6P/5AwDACoMaAwAAnoIaAwAAnoLvYwAAwFNwHgMAAJ6CGgMAAJ6CGgMAAJ6CGgMAAJ6CGgMAAJ6CGgMAAJ6CGgMAAJ6CGgMAAJ6CGgMAAJ6CGgMAAJ6CGgMAAJ6CGgMAAJ6CGgMAAJ6CGgMAAJ6CGgMAAJ6CGgMAAJ6CGgMAAJ6CGgMAAJ6CGgMAAJ6CGgMAAJ6CGgMAAJ6CGgMAAJ6CGgMAAJ6CGgMAAJ7yfy7bqcd7X+GPAAAAAElFTkSuQmCC)

Screenshot: mulphico.pk  vulnerability

Mirror: Click here to view the mirror

Coordinated Disclosure Timeline

Vulnerability Reported: 28 March, 2020 21:28 GMT
Vulnerability Verified: 28 March, 2020 21:37 GMT
Website Operator Notified: 28 March, 2020 21:37 GMT
a. Using the ISO 29147 guidelines
b. Using publicly available security contacts
c. Using Open Bug Bounty notification framework
d. Using security contacts provided by the researcher
Public Report Published
[without any technical details]: 28 March, 2020 21:37 GMT
Additional notification email sent: 23 June, 2020 07:33 GMT
Public Disclosure: A security researcher can delete the report before public disclosure, afterwards the report cannot be deleted or modified anymore. The researcher can also postpone public disclosure date as long as reasonably required to remediate the vulnerability. 26 June, 2020 21:28 GMT